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EXECUTIVE SUMMARY 


STS-37 /Atlantis was launched on April 5, 1991 from Kennedy Space Center launch 
complex 39B at 9:23 a.m. Eastern Standard Time (EST). Launch was delayed 4 minutes 
45 seconds because of range safety concerns about the low cloud ceiling and the wind 
direction in the potential blast area. 

Significant modifications were made to Atlantis during its 15-week stay in the 
Orbiter Processing Facility. These modifications included installation of 5 new General 
Purpose Computers (GPCs) that provide increased capabilities. Each new GPC is 52 
pounds lighter and requires approximately 90 watts less power than the older computer 
unit it replaces. Carbon brakes were installed on the Atlantis Main Landing Gear for 
the STS-37 mission in place of the carbon-lined beryllium brakes. This new carbon 
brake system provides extended brake life and an improved performance margin that 
lowers the safety risk during landings. 

The four STS-37 mission objectives were: (1) deployment of the Gamma Ray 
Observatory (GRO), the second of four planned "Great Observatories" being built by 
NASA to study the universe across the electromagnetic spectrum (the others are the 
Hubble Space Telescope, launched in April, 1990; the Advanced X-ray Astrophysics 
Facility, expected to be launched in 1998; and the Space Infrared Telescope Facility, 
scheduled for launch at the end of the decade; (2) evaluation of Extravehicular 
Activities (EVAs) for potential application to Space Station operations; (3) conduct of 
several middeck payload experiments; and (4) conduct of a variety of Detailed 
Supplementary Objectives and Development Test Objectives. 

Based on the limited number and type of inflight anomalies encountered, the 
Space Shuttle operated satisfactorily throughout the STS-37 mission. A contingency 
EVA was performed by the crew on Flight Day (FD) 3 to free a sticky GRO high-gain 
antenna, after which the GRO primary payload was successfully deployed by the 
Orbiter’s Remote Manipulator System. The GRO, which weighed just over 35,000 
pounds, was the heaviest NASA science satellite ever deployed by the Space Shuttle into 
low-Earth orbit. The secondary payloads performed nominally. 

The scheduled entry/landing on FD 6 was waved off for one day due to high wind 
conditions at Edwards Air Force Base (EAFB). Atlantis landed on FD 7, April 11, 1991, 
on EAFB lakebed runway 33 at 9:55 a.m Eastern Daylight Time (EDT). 
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FOREWORD 


The Mission Safety Evaluation (MSE) is a National Aeronautics and Space 
Administration (NASA) Headquarters Safety Division, Code QS produced document 
that is prepared for use by the NASA Associate Administrator, Office of Safety and 
Mission Quality (OSMQ), and the Space Shuttle Program Director prior to each Space 
Shuttle flight. The intent of the MSE is to document safety risk factors that represent a 
change, or potential change, to the risk baselined by the Program Requirements Control 
Board (PRCB) in the Space Shuttle Hazard Reports (HRs). Unresolved safety risk 
factors impacting the STS-37 flight were also documented prior to the STS-37 Flight 
Readiness Review (FRR) (FRR Edition) and prior to the STS-37 Launch Minus Two- 
Day (L-2) Review (L-2 Edition). This final Postflight Edition evaluates performance 
against safety risk factors identified in the previous MSE editions for this mission. 

The MSE is published on a mission-by-mission basis for use in the FRR and is 
updated for the L-2 Review. For tracking and archival purposes, the MSE is issued in 
final report format after each Space Shuttle flight. 
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SECTION 1 


INTRODUCTION 


1.1 Purpose 

The Mission Safety Evaluation (MSE) provides the Associate Administrator, Office 
of Safety and Mission Quality (OSMQ), and the Space Shuttle Program Director with 
the NASA Headquarters Safety Division position on changes, or potential changes, to 
the Program safety risk baseline approved in the formal Failure Modes and Effects 
Analysis/Critical Items List (FMEA/CIL) and Hazard Analysis process. While some 
changes to the baseline since the previous flight are included to highlight their 
significance in risk level change, the primary purpose is to ensure that changes which 
were too late to include in formal changes through the FMEA/CIL and Hazard Analysis 
process are documented along with the safety position, which includes the acceptance 
rationale. 

1 2 Scope 

This report addresses STS-37 safety risk factors that represent a change from 
previous flights, factors from previous flights that had an impact on this flight, and 
factors that are unique to this flight. 

Factors listed in the MSE are essentially limited to items that affect, or have the 
potential to affect, Space Shuttle safety risk factors and have been elevated to Level I 
for discussion or approval. These changes are derived from a variety of sources such as 
issues, concerns, problems, and anomalies. It is not the intent to attempt to scour lower 
level files for items dispositioned and closed at those levels and report them here; it is 
assumed that their significance is such that Level I discussion or approval is not 
appropriate for them. Items against which there is clearly no safety impact or potential 
concern will not be reported here, although items that were evaluated at some length 
and found not to be a concern will be reported as such. NASA Safety Reporting System 
• (NSRS) issues are considered along with the other factors, but may not be specifically 
identified as such. 

Data gathering is a continuous process. However, collating and focusing of MSE 
data for a specific mission begins prior to the mission Launch Site Flow Review (LSFR) 
and continues through the flight and return of the Orbiter to Kennedy Space Center 
(KSC). For archival purposes, the MSE is updated subsequent to the mission to add 
items identified too late for inclusion in the prelaunch report and to document 
performance of the anomalous systems for possible future use in safety evaluations. 
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lj Organization 

The MSE is presented in eight sections as follows: 

Section 1 - Provides brief introductory remarks, including purpose, scope, 
and organization. 

Section 2 - Provides a s umm ary description of the STS-37 mission, 

including launch data, crew size, mission duration, launch and 
landing sites, and other mission- and payload-related 
information. 

Section 3 - Contains a list of safety risk factors/issues, considered resolved 
or not a safety concern prior to STS-37 launch, that were 
impacted or repeated by anomalies reported for the STS-37 
flight. 

Section 4 - Contains a list of safety risk factors that were considered 
resolved for STS-37. 

Section 5 - Contains a list of Inflight Anomalies (IF As) that developed 
during the STS-35 mission, the previous Space Shuttle flight. 

Section 6 - Contains a list of IFAs that developed during the STS-38 

mission, the previous flight of the Orbiter Vehicle (OV-104). 

Section 7 - Contains a list of IFAs that developed during the STS-37 

mission. Those IFAs that are considered to represent a safety 
risk will be addressed in the MSE for the next Space Shuttle 
flight. 

Section 8 - Contains background and historical data on the issues, 

problems, concerns, and anomalies addressed in Sections 3 
through 7. This section is not normally provided as part of the 
MSE, but is available upon request. It contains presentation 
data, white papers, and other documentation. These data were 
used to support the resolution rationale or retention of open 
status for each item discussed in the MSE. 

Appendix A - Provides a list of acronyms used in this report. 
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SECTION 2 


STS-37 MISSION SUMMARY 


2.1 Summary Description of the STS-37 Mission 

STS-37 1 Atlantis was launched on April 5, 1991, from Kennedy Space Center (KSC) 
launch complex 39B at 9:23 a.m. Eastern Standard Time (EST). Launch was delayed 
4 minutes 45 seconds because of range safety concerns about the low cloud ceiling and 
the wind direction in the potential blast area. 

Significant modifications were made to Atlantis during its 15-week stay in the 
Orbiter Processing Facility (OPF). These modifications included installation of 5 new 
General Purpose Computers (GPCs) that provide increased capabilities. Each new GPC 
is 52 pounds lighter and requires approximately 90 watts less power than the older 
computer unit it replaces. Carbon brakes were also installed on the Atlantis Main 
Landing Gear (MLG) for the STS-37 mission; STS-31/OV-103 was the first flight 
equipped with these carbon brakes in place of the carbon-lined beryllium brakes used on 
all Orbiters since the beginning of the Space Shuttle Program. This new carbon brake 
system provides extended brake life and improved performance margin that lowers the 
safety risk during landings. In addition to these modifications to the Orbiter, a 
Hydrogen Dispersal System (HDS) was installed on Mobile Launch Platform (MLP) #1 
for STS-37. This system provides a Nitrogen (N 2 ) purge from the MLP to the 17" 
disconnect area to dilute or disperse a potential Hydrogen (H 2 ) leak. However, 
excessive H 2 leakage was not encountered at the 17" disconnect during STS-37 launch 
operations, and the purge system was therefore not used. 

The four STS-37 mission objectives were: (1) deployment of the Gamma Ray 
Observatory (GRO), the second of four planned "Great Observatories" being built by 
NASA to study the universe across the electromagnetic spectrum [the others are the 
Hubble Space Telescope (HST), launched in April 1990; the Advanced X-ray 
Astrophysics Facility, expected to be launched in 1998; and the Space Infrared Telescope 
Facility, scheduled for launch at the end of the decade]; (2) evaluation of Extravehicular 
Activities (EVAs) for potential application to Space Station operations; (3) conduct of 
several middeck payload experiments; and (4) conduct of a variety of Detailed 
Supplementary Objectives (DSOs) and Development Test Objectives (DTOs). 

The GRO was deployed on Flight Day (FD) 3. The GRO, which weighed just 
over 35,000 pounds, was the heaviest NASA science satellite ever deployed by the Space 
Shuttle into low-Earth orbit. Both solar arrays deployed successfully. The antenna latch 
sensors indicated that the latches were retracted in preparation for antenna deployment. 
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However, the GRO high-gain antenna did not deploy when commanded. A contingency 
EVA was performed by the crew; EVA crewmembers were successful in freeing the 
high-gain antenna, and it was subsequently deployed. The GRO was then released from 
the Orbiter’s Remote Manipulator System (RMS). 

On FD 4, activities were devoted almost entirely to planned EVA activities. These 
were accomplished successfully, and no significant problems were encountered. 

Based on the limited number and type of Inflight Anomalies (IF As) encountered, 
the Space Shuttle operated satisfactorily throughout the STS-37 mission. The more 
significant anomalies and problems are summarized below. 

Postlaunch data analysis of the Backup Flight System (BFS) telemetry indicated 
that, from the prelaunch BFS OPS-1 transition until the T-8 second (sec) BFS 
reinitialization, the Z-component (altitude) of the BFS state vector was increasing at a 
rate of approximately 1 foot per second (ft/sec) to approximately 7700 ft. The BFS 
navigation errors were cleared at the T-8 sec point in the launch countdown when the 
BFS was reinitialized to the pad B position. Ascent telemetry review indicated that both 
the BFS and the Primary Avionics Software System (PASS) performed nominally. 

Recent pre-STS-37 tests, conducted in the Shuttle Avionics Integration Laboratory 
(SAIL) with the new GPCs, demonstrated errors of 4000-4500 ft. Errors were believed 
to be caused by gravity feedback; this eventually led to error growth in the 
Z-component. The investigation included a code audit of the BFS and PASS, and it was 
determined that the problem was only in the first initialization of the navigation function 
in the BFS. The PASS navigation function did not have the same problems. Testing of 
the BFS at the SAIL repeated the STS-37 prelaunch anomaly on each attempt and 
demonstrated that the problem was not from the Inertial Measurement Unit (IMU) 
input. It is believed that this anomaly was caused by the increased processing time of 
the new GPCs combined with the way the BFS sequences initialization of the navigation 
function. Discrepancy Report (DR) 106197 was generated to identify this problem for 
resolution. 

During ascent, after Main Engine Cutoff (MECO), Water Spray Boiler (WSB) #2 
experienced spray bar freeze-up while on controller "A" and failed to cool Auxiliary 
Power Unit (APU) #2 lube oil after the end of the pool boiling period. The crew 
switched to controller "B", and operation was normal. The crew later switched back to 
controller "A" just before APU shutdown, and WSB #2 continued to function normally; 
both controllers were then considered functional. WSB #2 on STS-37 was a new boiler, 
and both APU #2 and WSB #2 were hot oil flushed. The most probable cause of this 
problem was wax buildup in the WSB due to APU hydrazine fuel mixing with the lube 
oil. Research of the WSB cooling problem indicated that APU #2, Serial Number 
(S/N) 208, had been involved in 6 out of 13 freeze-ups; and on the flights in which APU 
S/N 208 and WSB #2 had been paired, the spray bar freeze-up occurred in 5 out of 
5 flights. Further investigation into the cause of this anomaly is continuing. 

Reaction Control System (RCS) thruster R1U failed "off' the first time it was used 
[during the STS-37 External Tank (ET) separation maneuver]. R1U was deselected by 
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Redundancy Management (RM). The immediate concern with trying to recover a failed 
"off' thruster is the risk of obt ainin g a large leakage caused by contamination after the 
thruster is fired. The flight rule states that a failed thruster should be kept deselected 
unless needed for attitude control or to protect against the loss of fail-safe redundancy. 
There were 2 other right, upward-firing thrusters available in addition to the failed R1U 
unit. The R1U thruster was not fired during the mission. It is believed that the cause 
of the failure was iron nitrate contamination within the thruster inlet valves, similar to 
that seen on STS-36 thrusters R3D and R4R. The STS-37 R1U thruster was removed 
when Atlantis returned to KSC; the unit was sent to the White Sands Test Facility 
(WSTF) for further failure analysis. 

On-orbit operation of the ET umbilical doors was reported to be nominal for 
STS-37. Prior to launch, there was an issue concerning the ET umbilical doors because 
of starter cracks were discovered in 3 of 4 door lug clevises (see Section 4, Orbiter 1). 
The decision was made not to remove and replace the ET door lug housings on OV-104 
prior to flight. Postflight visual inspection of the lug clevises found no apparent crack 
growth as a result of ET umbilical door operation on orbit. The OV-104 door lug 
housings were removed after the STS-37 flight and replaced with the modified "J-leg" lug 
design housings. 

The scheduled entry/landing on FD 6 was waved off for 1 day due to high wind 
conditions at Edwards Air Force Base (EAFB). Atlantis landed on FD 7, April 11, 1991, 
on EAFB lakebed runway 33 at 9:55 a.m. Eastern Daylight Time (EDT). The GRO 
primary payload had been successfully deployed and the secondary payloads performed 
nominally. 

STS-37/OV-104 touched down more than 600 feet (ft) short of the threshold on 
EAFB lakebed runway 33. During descent, Atlantis encountered wind shear from 
13,000 ft down to 9,000 ft, which resulted in a wider than computed Heading Alignment 
Cone (HAC) and lower energy at the transition to the approach and landing interface. 
Wind shear was again encountered at approximately 1,000 ft. At preflare, Atlantis was 
approximately 1,000 ft below the referenced altitude, resulting in a range error of 
3,200 ft. A second wind shear, encountered at an altitude of approximately 1,000 ft, 
further reduced the range by 850 ft. The crew used all remaining energy to protect 
against a hard landing and high nose gear slapdown loads. Postflight reviews revealed 
that information concerning wind shear, gathered by the Shuttle Training Aircraft (STA) 
during prelanding evaluation runs, could have been relayed to Atlantis. If the pilot had 
known about the wind shear in the HAC area, steps could have been taken to mitigate 
wind shear effects. This incident has elevated the awareness of potential wind shear 
conditions and the potential effects of wind shear after passing the terminal area energy 
management interface. 

Postlaunch inspection at KSC revealed no facility anomalies. No flight hardware 
was found at the pad or in the area under the flightpath. About 3-4 ft of holddown post 
#1 firing cable was found to have remained attached to the Right Hand (RH) Solid 
Rocket Booster (SRB) aft skirt. 
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22 Flight/Vehicle Data 

• Launch Date: April 5, 1991 

• Launch Time: 9:23 a.m. EST 

• Launch Site: KSC Pad 39B 

• RTLS: Kennedy Space Center, Shuttle Landing Facility 

• TAL Site: Banjul, The Gambia 

• Alternate TAL Site: Ben Guerir, Morocco 

• Landing Site: Edwards AFB, CA Lakebed Runway 33 

• Landing Date: April 11, 1991 

• Landing Time: 9:55 a.m. EDT 

• Mission Duration: 6 Days, 0 Hours, 32 Minutes 

• Crew Size: 5 

• Inclination: 28.45’ 

• Altitude: 243 Nautical Miles/Direct Insertion 

• Orbiter: OV-104 (8) Atlantis 

• ET-37 

. SRBs: BI-042 

• RSRM Flight Set #14 

• MLP #1 
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ENGINE 


#2019 


POWERHEAD 

#2020 

MCC* 

#2023 

NOZZLE 

#2024 

CONTROLLER 

F4 

FASCOS* 

#23 

HPFTP* 

#6008 

LPFTP* 

#2022R1 

hpotp* 

#9309R2 

LPOTP* 

#2025R1 


* Acronyms can be found in Appendix A 
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#2031 


#2107 


#2028 

#2014 

#2019 

#4002 

#4017 

#4019 

F29 

F25 

#12 

#29 

#4010R3 

#6003R1 

#2120R1 

#4007 

#2027R3 

#252 1R2 

#2120 

#2216 
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23 First Flight of Upgraded General Purpose Computers 

The next-generation GPCs were flown for the first time on STS-37. The upgrade, 
model AP101S, has an overall memory capacity of 256 kilobytes (K) and will perform 
1000K operations per second. The AP101S Central Processing Unit and Input/Output 
Processor are in 1 box as opposed to 2 separate boxes in the model AP101B. The 
AP101S is approximately 52 pounds (lb) lighter than AP101B and requires 
approximately 90 watts less power. 

APlOISs were installed in OV-104 in all 6 positions; 5 active and 1 inflight spare. 
The installed units were: GPC #1 - S/N 511, GPC #2 - S/N 504, 

GPC #3 - S/N 501, GPC #4 - S/N 526, GPC #5 - S/N 508, and Spare - S/N 519. 

The 6 OV-103 GPCs have been operated for over 14,000 total hours (hr) (ranging from 
1381 hr to 3840 hr). For all APlOISs, there have been over 30,000 hr of operation. 

The AP101S design includes error detection and correction for single-bit errors 
and detection of 2-bit errors in each word of the GPC memory. Memory scrub is 
performed every 1.7 sec. AP101S microcode is improved over AP101B to reduce 
exposure to non-universal Input/Output (I/O) errors, a potential Crit 1/1 error 
condition. Available memory in the AP101S is 256K, comprising 2 pages of 128K each. 
However, the hardware design and current addressing scheme preclude effective use of 
the upper 128K of memory. Effort is underway to identify software changes that will 
enable efficient use of the upper memory. Current plans target the 01-24 flight software 
release, scheduled for availability in February 1992, for incorporation of this capability. 
Release 01-20, scheduled to be available in the Fail of 1991, will allow limited use of 
the upper memory. Software releases through OI-21 will require less than 128K of 
memory to operate effectively. This constraint to the full use of AP101S capabilities was 
not an issue for STS-37 because the AP101B is only capable of utilizing 128K of 
memory. 

There were hazards identified with the use of AP101S GPCs. However, minor 
additions and revisions were made to flight rules, crew procedures, and Launch Commit 
Criteria (LCC) to account for the use of AP101S. The launch team, crew, and mission 
operations team were trained with these changes in place. 

Two risk factors in Section 4 of this STS-37 Mission Safety Evaluation address 
problems associated with the new GPCs. The first, Orbiter 5, deals with the potential 
for the new GPCs to erroneously overwrite memory when commanded from the "sleep" 
mode. Procedural workarounds made this risk factor acceptable for STS-37 flight. The 
second, Orbiter 8, addresses the failure of a new GPC in the SAIL. This failure was 
accepted as an isolated, unexplained anomaly; it was not considered to be a generic 
GPC problem issue. 
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2.4 Software Upgrade for Orbiter and Space Shuttle Main Engine Controllers 

STS-37 was the first flight to use OI-8F software. The OI-8F Orbiter avionics 
software release was developed to support the introduction of the new AP101S GPCs. 
OI-8F is a combination of the OI-8D software release, first used on STS-41, and OI-9 A 
that was developed to support the basic hardware changes (i.e., increased memory and 
central processor speed) between the AP101B GPCs and the AP101S GPCs; there were 
no other application code changes. 

This was also the first flight of the AR02 software upgrade for the Space Shuttle 
Main Engine (SSME) controller. Modifications include extended monitoring of igniter 
"on-time" for verification of igniter quench, changes to KSC load timing to minimize 
load errors, and elimination of the Pogo precharge pressure sensor qualification limit 
post-shutdown to provide consistency with SSME redline logic. 


2.5 Hydrogen Dispersal System Installed on Mobile Launch Platform #1, STS-37 

The HDS was installed for the first time on MLP #1 for use with STS-37. This 
system provides a nitrogen purge from the MLP to the 17" disconnect area to dilute or 
disperse a potential Hydrogen (H 2 ) leak. The HDS includes a standpipe, approximately 
18 ft in height above the MLP zero deck, and 2 standpipe support legs welded to the 
MLP. There is a 16" outer pipe supporting and protecting a 2 " inner pipe through which 
Gaseous Nitrogen (GN 2 ) flows. A nozzle is connected to the inner pipe that is designed 
for nominal flow of 750 standard cubic feet per minute (scfm) of GN 2 at 125 pounds per 
square inch gage (psig). The acoustic level at the nozzle outlet was determined by 
analysis and test to be approximately 126 decibels. Purge velocity at the 17" disconnect 
area was determined to be approximately 35 knots. 

The structure above the MLP zero level was hardened for the launch environment. 
A blast cover protects the nozzle, and a rain cover (butcher paper) prevents water and 
other contamination from entering the purge systems. The standpipe and support 
structure was designed to handle a 15-psig acoustical overpressure from any direction 
with a Factor of Safety (FOS) of 2. 

Analyses were performed of worst-case conditions and potential vehicle drift at 
liftoff. For nominal liftoff drift, worst-case drift (3a with a 20-knot wind), and worst-case 
engine-out condition (la), analysis indicated that body flap trailing edge and left SRB 
aft skirt clearances were sufficient. On-pad engine shutdown excursion clearances were 
also determined to be sufficient. 

Criteria for the use of the HDS were established by the Space Shuttle Program. 
The HDS will only be used to enable a safe (or safer) detanking condition after a 
launch scrub has been declared due to high H 2 concentration at the 17" disconnect. The 
HDS will not be used to enable continuation of launch countdown in the presence of 
high H 2 concentrations. 


2-7 


STS-37 Postflight Edition 


Hazard analysis associated with the use of this system is also in work. The hazard 
analysis addresses the potential for debris impact on the vehicle, structural failure of the 
system, inadvertent operation, effects of use during fire or explosion at the pad, and 
contact with flight hardware during liftoff and abort. The focus of the analysis is on 
operation of the HDS as a "detank only" tool. 


2.6 Carbon Brakes 

STS-31/OV-103 was the first flight equipped with carbon brakes on the main 
landing gear. Carbon brakes were installed on OV-104 for the STS-37 mission. These 
brakes are replacing the carbon-lined beryllium brakes used on all Orbiters since the 
beginning of the Space Shuttle Program. The prime reasons for making this change 
were: improved performance margins that lower the safety risk during landings, extended 
brake life, and elimination of special handling procedures. STS-31 was selected for 
carbon brake system first flight because required instrumentation was available on 
OV-103. The carbon brake assembly comprises 5 rotors and 4 stators (increased from 4 
and 3, respectively) to increase the friction/braking area. The beryllium brake 
assemblies have carbon liners fastened to beryllium rotors; this further reduces the 
available rotor friction area. One-piece carbon rotors are used in the improved carbon 
brake assembly. Hydraulic pressure regulation is reduced by 500 pounds per square inch 
(psi) with the carbon brakes; operating pressure is 2000 psi. Energy absorption 
capability of the carbon brakes increases to 82,000,000 foot-pounds (ft-lb) from the 
18,000,000 ft-lb capacity of the beryllium brakes. This added capability provides a 
nominal brake life of over 20 landings/stops, much improved over the 5 maximum 
landings/stops of the beryllium brakes. The additional energy absorption capability 
allows an increase in nominal landing speed from 180 knots to 225 knots, lowering the 
risk associated with Retum-To-Launch-Site (RTLS) contingency landings at KSC. In 
addition to increased performance and extended useful life, elimination of the beryllium 
brakes decreases the health risk to technicians; beryllium is a highly toxic element. 

DTOs involving the carbon brakes, performed on OV-103, will be repeated on OV-104; 
some of these DTOs were performed during the STS-37 mission. 


2.7 Aft Compartment Hydrogen Concentration Launch Commit Criteria Limits 

Lessons learned during the 1990 H 2 leak investigation led to a reduction in the 
LCC for aft compartment H 2 concentration. From the start of tanking through stable 
replenish, the aft compartment H 2 LCC will remain at 500 parts per million (ppm) for 
OV-104. To further protect against the potential for leaks in the high-pressure side of 
the Main Propulsion System (MPS) exceeding flammability limi ts after engine start, the 
LCC was reduced from 300 ppm to 150 ppm for the period from stable replenish 
through prepressurization of the liquid hydrogen tank at T-117 seconds. This reduction 
was due to the fact that only 5 % of the high-pressure side is wetted prior to engine start. 
A leak in excess of 150 ppm during low-pressure operations in stable replenish was 
calculated to exceed the aft compartment flammability limit when entering high-pressure 
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operations. For the balance of the launch countdown, the aft compartment H 2 
concentration LCC remained the same as that for previous launches. 


2.8 Payload Data 

The four STS-37 mission objectives were to: deploy the Gamma Ray Observatory 
(GRO), evaluate a variety of Extravehicular Activities for potential application to Space 
Station operations, conduct several middeck payload experiments, and conduct a variety 
of DSOs and DTOs. The GRO is the second of 4 planned "Great Observatories"; the 
others are the Hubble Space Telescope, the Advanced Astrophysics Facility, and the 
Space Infrared Telescope Facility. 

On the fourth day of the STS-37 flight, the Extravehicular Activities 
Developmental Flight Experiment (EDFE) required the first space walk by American 
astronauts since November 1985. The space walk tested 3 prototype cart designs, the 
Shuttle’s robot arm as a work platform for astronauts, and instrumented evaluation of 
astronauts’ ability to work with tools in a weightless environment. 

Payload Bay: 

• GRO - investigates extraterrestrial gamma-ray sources. 

• EDFE - included 3 sets of evaluations: 

- Crew and Equipment Transaction Aid (CETA) - a multipurpose crew 
system that provides rapid return to the Space Shuttle airlock in case of 
an emergency, allows efficient translation, and carries equipment. The 
CETA consists of 3 carts and a tether Shuttle. 

- Crew Loads Instruments Pallet Experiment (CLIP) - provides EVA 
crew loads data. 

- EVA Translation Evaluation (ETE) - evaluates EVA translation rates 
and techniques while performing representative scenarios of Space 
Station operations. 

• Ascent Particle Monitor (APM) - collects particulate materials from the 
Orbiter during ascent, using an automated mechanical/electrical assembly. 

• Space Station Heat Pipe Advanced Radiator Element (SHARE) - 
demonstrates and quantifies the microgravity thermal vacuum performance 
of a high-capacity, space-constructible, heat pipe radiator element for heat 
rejection as a prelude to development of a Space Station heat rejection 
system. 
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Middeck: 


• Protein Crystal Growth (PCG HI) - obtains high-quality protein crystals in 
a controlled temperature module. 

• Radiation Monitoring Equipment (RME III) - measures the rate and 
dosage of ionizing radiation to the crew at different locations throughout 
the Orbiter cabin. The hand-held instrument measures gamma ray, 
electron, neutron, and proton radiation and calculates the amount of 
exposure. 

• Shuttle Amateur Radio Equipment (SAREX II) - provides a low-cost 
space-to-ground voice and slow-scan television experiment. 

• Air Force Maui Optical Station (AMOS) - technology development/ 
geophysical environment study to calibrate AMOS ground-based electro- 
optical sensors and study on-orbit plume phenomenology using the Shuttle 
as a test object. 

• Bioserve ITA Materials Dispersion Apparatus (BIMDA) - includes a wide 
range of tests focused on the assembly of macromolecules in a thermal 
enclosure. 


2.9 Gamma Ray Observatory Description 

The primary objective of the GRO is to obtain a large body of high-quality data to 
greatly enhance knowledge and understanding of the spectra and scale of gamma ray 
and associated galactic activity. It is expected that much of the obscuration and 
handicaps of telescopic observation on earth can be overcome by conducting 
observations from earth orbital altitudes with an observatory capable of full-sky pointing. 

The GRO provides a capability for Space Shuttle crew to conduct extravehicular 
operations for On-Orbit Refueling (OOR), maintenance and repair, and on-orbit 
retrieval. The GRO is comprised of three major elements: the integrated instrument 
package, a carrier platform, and flight support equipment. It is deployed by the 
Orbiter’s RMS. 

Instrument Package 

Gamma rays constitute a part of the electromagnetic spectrum, similar to radio 
waves, visible light, or x-rays. However, the gamma ray portion of the spectrum is much 
broader than these other regions. The gamma ray spectrum is over 10,000 times the 
range of visible light and over 100 times that of x-rays. 
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The astrophysics information of interest is spread over the full range of gamma ray 
energies. No single instrument can cover the entire range; thus, GRO carries 
4 different instruments, including one that will look for and measure gamma ray bursts. 

Oriented Scintillation Spectrometer Experiment fOSSEl 

The low-energy range from 0.1-10 million electron volts (MeV) is covered by the 
OSSE which consists of 4 separate detectors that can rotate independently to look at 
different parts of the sky. The sensitivity of this instrument is over 10 times greater than 
that of any unit previously flown. It is able to determine the direction of a source to a 
fraction of a degree. 

Imaging Compton Telescope fCOMPTELl 

This is a midrange instrument that covers the range of energies from 1-30 MeV 
and is able to determine angle of arrival to within less than a degree at the higher 
energies. It can measure the energy of photons to within 5 percent (also at the higher 
energies). Special provisions were made to reduce background radiation effects. 

Energetic Gamma Rav Experiment Telescope (EGRET) 

For the highest energy range, from 20-30 MeV, the EGRET is capable of 
measuring the position of a source to a fraction of a degree and the energy of individual 
photons to within 15 percent. 

Burst and Transient Source Experiment (BATSE1 

The BATSE continuously observes the full sky (except for Earth blockage) for 
gamma ray bursts or other short-duration phenomena, and also interacts with other 
instruments when a burst is taking place. It makes a full-sky survey of long-lived 
(strong) sources. The BATSE modules measure gamma rays in the range from 0.05-6 
MeV and incorporates a separate spectroscopy detector with a 0.02-10 MeV range. 

Collectively, these 4 GRO instruments weigh nearly 7 tons. The full observatory, 
including these instruments, weighs approximately 35,000 lb. It was designed to be 
launched, serviced, and retrieved by the Space Shuttle. It can also be commanded to 
perform a power-controlled reentry and splashdown. The GRO provides 
communications, data handling, electric power, and attitude functions to all 
4 instruments. 

From launch until GRO deployment, all 4 instruments are unpowered except for 
Orbiter-powered heater operation in the payload bay after the doors are opened. These 
heaters are turned off prior to GRO removal from the payload bay by the RMS. 
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SECTION 3 


SAFETY RISK FACTORS/ISSUES IMPACTED BY STS-37 ANOMALIES 


This section lists safety risk factors/issues, considered resolved (or not a safety 
concern) for STS-37 prior to launch (see Sections 4, 5, and 6), that were repeated or 
related to anomalies that occurred during the STS-37 flight (see Section 7). The list 
indicates the section of this Mission Safety Evaluation (MSE) Report in which the item 
is addressed, the item designation (Element/Number) within that section, a description 
of the item, and brief comments concerning the anomalous condition that was reported. 
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ITEM 


COMMENT 



ORB1TER 12 Clogged Auxiliary Power During the pad confidence run hot-fire 
Unit (APU) #3 lube oil of STS-37/OV-104 APU #3, S/N 307, 
filter on OV-104. gearbox lube oil pressure peaked at 108 

pounds per square inch absolute (psia). 
High gearbox pressure is an indication 
of wax buildup and the potential for a 
clogged filter. Gearbox pressure is 
nominally 50 psia during APU 
operation. A clogged filter could cause 
Water Spray Boiler (WSB) spray bar 
freeze-up and an over-temperature 
condition of the APU post-Main Engine 
Cutoff (MECO). The Operational 
Maintenance Requirements and 
Specifications Document (OMRSD) 
requires a hot-oil flush if evidence of 
filter clogging is present. However, an 
APU hot-oil flush has never been 
performed in the vertical position; an 
OMRSD procedure would have to be 
written to accomplish the flush. The 
decision was made to drain the lube oil 
from APU #3 and replace the lube oil 
filter. 


STS-37/OV-104 System #3 APU/WSB 
post-MECO lube oil temperature ran 
cooler than the other 2 systems; lube oil 
return temperature was 231 °F 
minimum. System #3 saw a second 
overcool during entry; lube oil return 
temperature was 211 °F minimum. 
Contamination of System #3 
APU/WSB was suspected. 

(IF A No. STS-37-V-12) 
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ITEM 


COMMENT 


Section 4: Resolved STS-37 Safety Risk Factors 


ORBITER 12 
(Continued) 


Clogged APU #3 lube oil STS-37/OV-104 WSB #2, which did not 
filter on OV-104. indicate any problems during prelaunch 

tests, failed to cool APU #2 lube oil 
during STS-37 ascent. When lube oil 
temperature reached 280 °F, the crew 
switched from WSB controller "A" to 
controller "B"; nominal cooling begins at 
250’F. The most probable cause of 
this anomaly was freezing of the spray 
bar due to wax buildup in WSB #2. 
Investigation into APU/ WSB 
combinations that displayed similar 
problems is in work. The same 
anomaly occurred during STS-38, the 
previous flight of OV-104 (IFA No. 
STS-38-01). Both controller "A” and 
WSB #2 were removed and replaced on 
OV-104 after STS-38. 

(IFA No. STS-37- V-02A/B) 
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ITEM 


COMMENT 


Section 5: STS»35 Inflight Anomalies 

During STS-35 ascent, WSB #3A did 
not initiate spray cooling until APU #3 
lube oil return temperature reached 
277° F. WSB cooling operation should 
begin at 250 *F. During reentry 
operations, WSB #3A overcooled the 
lube oil. A similar anomaly occurred 
with WSB #2A on STS-38/OV-104. 

(See Section 6, Orbiter 1 for more 
details.) 

S imil ar problems were encountered with 
WSB #2 and #3 operation on STS-37. 
WSB #2 did not cool APU lube oil 
while under operation of controller "A", 
and operation had to be switched to 
controller "B" when lube oil 
temperature reached 280 °F. The most 
probable cause of the problem was 
again believed to be freezing of the 
spray bar due to wax buildup in 
WSB #2. WSB #3 overcooling was 
encountered post-MECO and again 
during entry. Contamination of 
System #3 APU/WSB was suspected. 
(See Section 7, Orbiter 2 and Orbiter 6 
for more details.) 

(IFA No. STS-37- V-02A/02B and 
IFA No. STS-37- V- 12) 


ORBITER 5 WSB #3A operation was 
abnormal during ascent 
and entry. 

IFA No. STS-35-17 
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ITEM 


COMMENT 


Section 5: STS-35 Inflight Anomalies 


ORBITER 8 Reaction Control System 
(RCS) vernier thruster 
R5D failed "off'. 

IFA No. STS-35-20 


During STS-35 orbital maneuvering, 

RCS vernier thruster R5D exhibited low 
Chamber Pressure (P c ) and was 
deselected by Redundancy Management 
(RM). Data evaluation indicated that 
helium was present in the crossfeed 
line. A similar failure was seen on 
STS-9. Vernier thruster R5D was 
successfully hot-fired on orbit to flush 
out the helium. Evaluation of the 
hot-fire data indicated some gas 
ingestion during the first pulse and none 
in the 4 subsequent pulses. RM was 
reset following nominal performance 
during the hot-fire. 


During STS-38/OV-104, low P c was 
experienced on 4 primary thrusters: 
R1U, R3D, RF3L, and R4U. Postflight 
troubleshooting did not reveal any 
thruster leaks or other anomalies which 
might lead to low thruster P c . 
Subsequent analysis determined that 
these STS-38 thrusters all indicated low 
P c during interconnect operations; the 
right pod thruster manifold was 
interconnected to the left Orbital 
Maneuvering System (OMS) propellant 
tanks. When RP03 propellant source 
was switched from the right OMS 
propellant tanks back to the straight 
feed configuration, thruster P c in R1U, 
R3D, RF3L, and R4U returned to 
nominal. 


This finding led to the decision to 
perform thruster firings on 
STS-37/OV-104 in the interconnect 
configuration. When this was 
performed, thrusters LIU and L1L 
showed degraded P 0 approximately 
130 psia instead of 150 psia nominal. 

P c in LIU and L1L returned to nominal 
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ITEM 


COMMENT 


Section 5; STS 


ORBITER 8 
(Continued) 


-35 Inflight Anomalies 

after reconfiguration to straight feed. It 
is believed that there was contamination 
in the oxidizer interconnect line. 
Troubleshooting will be performed at 
KSC. (See Section 7, Orbiter 4 for 
more details.) 

(IFA No. STS-37-V-08) 

RCS primary thruster R1U failed "off’ 
during the External Tank (ET) 
separation maneuver on STS-37. In this 
case, the problem was believed to be 
caused by iron nitrate contamination of 
the oxidizer valve poppet; pressure 
traces from the R1U failure were 
similar to those seen on STS-36 thruster 
failures that were attributed to this type 
of contamination. (See Section 7, 
Orbiter 1 for more details.) 

(IFA No. STS-37-V-01) 


RCS vernier thruster R5D 
failed "off". 
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ITEM 


COMMENT 


Section 6 : STS-38 Inflight Anomalies 


ORBITER 1 


WSB #2 did not cool APU 
lube oil while under 
operation of controller "A". 

IFA No. STS-38-01 


STS-38/OV-104 WSB #2 controller "A" 
failed to cool APU lube oil after the 
end of the pool boiling period during 
ascent. The crew switched to controller 
"B" when the temperature reached 
275 °F, and APU #2 was left "on" after 
APUs #1 and #3 were shut down. 

After switching to controller "B", lube 
oil temperature peaked at 300 °F before 
cooling was observed after 66 seconds 
(sec). Controller "A" was selected for 
reentry to determine if the temperature 
control operated properly; controller 
"A" operated normally. It was believed 
that spray bar freeze-up on controller 
"A" during ascent caused the problem. 
Freezing of the spray bar could have 
been caused by low heat load on 
APU #2, or controller "A" was not 
functioning properly. A similar cooling 
problem was experienced on STS-1 
through STS-4 and on STS-35/OV-102. 
(IFA No. STS-35-V-17) 


Similar problems were encountered with 
WSB #2 operation on STS-37. WSB 
#2 did not cool APU lube oil while 
under operation of controller "A", and 
operation had to be switched to 
controller "B" when lube oil 
temperature reached 280 °F. The most 
probable cause of the problem was 
again believed to be freezing of the 
spray bar due to wax buildup in the 
WSB #2. (See Section 7, Orbiter 2 for 
more details.) 

(IFA No. STS-37- V-02A/B) 
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SECTION 4 


RESOLVED STS-37 SAFETY RISK FACTORS 


This section contains a summary of the safety risk factors that were considered 
resolved for STS-37. These items were reviewed by the NASA safety community. A 
description of the risk factor, information regarding problem resolution, and rationale 
for flight are provided for each safety risk factor. The safety position with respect to 
resolution is based on findings resulting from System Safety Review Panel (SSRP), 
Prelaunch Assessment Review (PAR), and Program Requirements Control Board 
(PRCB) evaluations (or other special panel findings). It represents the safety assessment 
arrived at in accordance with actions taken, efforts conducted, and tests/retests and 
inspections performed to resolve each specific problem. 

Hazard Report (HR) numbers associated with each risk factor in this section are 
listed beneath the risk factor title. Where there is no baselined HR associated with the 
risk factor, or if the associated HR has been eliminated, none is listed. Hazard closure 
classification, either Accepted Risk {AR} or Controlled {C}, is included for each HR 
listed. 


The following risk factors, contained in this section, represent an increase in risk 
above the Level I approved Hazard Baseline. 


Integration 1 


Orbiter 1 


New Criticality 1 and 1/R2 failure modes have been identified for 
the Rate Gyro Assemblies on the Orbiter and Solid Rocket 
Boosters. 

External Tank umbilical door lug clevis cracks on STS-37/OV-104. 
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SECTION 4 INDEX 


RESOLVED STS-37 SAFETY RISK FACTORS 

ELEMENT/ RISK 

SEQ. NO. FACTOR PAGE 

INTEGRATION 

1 New Criticality 1 and 1/R2 failure modes have been identified for the 4-4 

Rate Gyro Assemblies on the Orbiter and Solid Rocket Boosters. 

ORBITER 

1 External Tank umbilical door lug clevis cracks on STS-37/OV-104. 4-7 

2 STS-39/OV-103 pilot-side Display Driver Unit Attitude Direction 4-12 

Indicator ball hesitation. 

3 STS-37/OV-104 Auxiliary Power Unit #3, Serial Number 307, 4-13 

uncommanded Gas Generator Valve Module Shutoff Valve motion. 

4 New Data Processing System failure could lead to a Criticality 1/1 4-14 

condition. 

5 Potential for new General Purpose Computers to erroneously 4-16 

overwrite memory. 

6 Cabin pressure bleed valve anomalies on OV-105. 4-19 

7 OV-104 wing strut tubes found damaged during STS-38 postflight 4-20 

inspection. 

8 New General Purpose Computer, AP-101S, failure mode. 4-21 

9 Indications of voids and debris found in review of STS-37/OV-104 4-22 

Nose Landing Gear holograms. 

10 A Main Propulsion System 3-way helium solenoid valve failed leak 4-24 

tests on OV-102. 

11 Gaseous Hydrogen Flow Control Valve weld crack found on OV-103. 4-27 

12 Clogged Auxiliary Power Unit #3 lube oil filter on OV-104. 4-29 

13 Debris found in STS-37/OV-104 window #1. 4-31 

SSME 

1 High-Pressure Oxidizer Turbopump first-stage turbine disc cracking. 4-32 

2 Suspected contamination of engine #2029 High-Pressure Oxidizer 4-34 

Turbopump. 

3 Pogo standpipe thermal insulator may have been inadvertently 4-35 

removed during final engine assembly. 
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SECTION 4 INDEX - CONTINUED 


RESOLVED STS-37 SAFETY RISK FACTORS 

ELEMENT/ RISK 

SEQ. NO. FACTOR PAGE 

SSME 

4 Potential for pad abort caused by purge check valve seat leakage. 4-35 

5 Potential for loss of Space Shuttle Main Engine controller 4-37 

redundancy. 

6 High-Pressure Oxidizer Turbopump second-stage turbine blades found 4-38 

rubbing coolant jet tubes on Unit Number 6009. 

7 Engine #0213, G-15 seal failed during ground testing at Stennis Space 4-39 

Center. 

SRB 

1 Solid Rocket Booster Auxiliary Power Unit speed trace anomaly 4-40 

during Acceptance Checkout. 

2 Thrust Vector Control hydraulic reservoir found with 1/4" nut wedged 4-42 

between piston and cylinder head. 

SRM 

1 Test and Evaluation Motor-7 fixed housing ablative liner debond. 4-44 

2 Inner Boot Ring bond line separation on STS-38 right-hand Solid 4-44 

Rocket Motor. 

3 Room Temperature Vulcanizing was found past the primary O-ring of 4-46 

nozzle joint #5 on disassembly of Test and Evaluation Motor-7. 
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RESOLVED STS-37 SAFETY RISK FACTORS 


ELEMENT/ 
SEQ. NO. 


INTEGRATION 

1 


RISK COMMENTS/RISK ACCEPTANCE 

FACTOR RATIONALE 


New Criticality (Crit) 1 and 1/R2 failure 
modes have been identified for the Rate 
Gyro Assemblies (RGAs) on the Orbiter 
and Solid Rocket Boosters (SRBs). 

HR No. INTG-144C {C} 

INTG-165A {C} 

B-50-18 Rev. C-DCN2 {C} 

No RGA problems were reported on 
STS-37. 


Review of recent RGA test data indicated occurrence of a large output transient, up 
to 45% of full scale, that lasts approximately 10 seconds (sec) when power to an 
RGA is lost. It was previously believed that the RGA output would immediately go 
to zero when power was removed. In operation, Redundancy Management (RM) 
software normally selects the second highest output value from 1 of 4 SRB RGAs 
for further processing. Post-SRB separation during ascent, and during descent, RM 
will select the second highest output value from 1 of 4 Orbiter RGAs. However, 
because it is now known that RGA output can stay high for as long as 10 sec after 
power is removed, the potential exists for RM to select erroneous output data from 
an RGA that has lost power as the second highest value. Selection of erroneous 
data could lead to loss of vehicle control and subsequent loss of the crew and 
vehicle. 

Reevaluation of the RGA Failure Modes and Effects Analysis (FMEA) for Orbiter 
and SRB RGA power circuits and the effects of simultaneous loss of power to 2 
RGAs identified Crit 1/R2 failure modes for both the Orbiter and SRB RGAs. 

The first failure could be a latent, redundant power feed circuit component (i.e., a 
remote power controller, a diode failing open, etc.). The second potential failure 
could be loss of a second string redundant path and power feed to another RGA 
with a non-redundant power source. These 2 failures would result in simultaneous 
loss of power to 2 RGAs. A Crit 1/1 failure mode was found to be associated with 
the SRB RGAs. No Crit 1/1 failure modes were identified for the Orbiter RGAs. 
In the case of the SRB RGAs, demate of a single connector (55W1P113/J3) on the 
Orbiter Master Event Controller (MEC) #2 or in the Orbiter Avionics Bay #5 
feedthrough (50W92P299/J99) will result in simultaneous loss of power to 2 SRB 
RGAs. Additionally, opening of all 3 poles of the 3-pole MEC #2 power toggle 
switch will also cause simultaneous loss of power to 2 SRB RGAs. Power 
distribution to the RGAs within the SRBs is redundant. 
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RESOLVED STS-37 SAFETY RISK FACTORS 


ELEMENT/ 
SEQ. NO. 


INTEGRATION 
1 (Continued) 


RISK COMMENTS/RISK ACCEPTANCE 

FACTOR RATIONALE 


New Crit 1 and 1/R2 failure modes have Two Critical Item List (CIL) waivers, CR S50260D and CR S50260S, were 

been identified for the RGAs on the submitted to address the new Crit 1/1 and 1/R2 conditions identified and were 

Orbiter and SRBs. approved for STS-37/OV-104 and STS-39/OV-103. CR S50260D addresses 

component and power bus failures in the Orbiter that create the Crit 1/R2 
condition for Orbiter and SRB RGAs. CR S50260S addresses the 2 Orbiter 
connector demates/failures that create the Crit 1/1 condition for SRB RGAs. An 
existing Crit 1/1 CIL for the 3-pole MEC #2 power toggle switch is unchanged by 
these findings. 

Flight Rule (FR) 8-47 was prepared to reduce the risk of simultaneous RGA power 
loss and output of erroneous data. This FR directs the crew to deselect 1 Orbiter 
RGA when the first failure is detected. Ground test procedures were incorporated 
to verify the integrity of the SRB RGA backup power logic source during essential 
power bus tests at T-l hour. Photographic documentation of the Crit 1/1 
connectors was also mandated to ensure proper connector seating. Review of the 
applicable photographs and video tape determined that these connectors were 
properly installed. Review of recent processing records determined that the critical 
connectors, 55W1P113/J3 and 50W92P299/J99, had not been demated since the 
STS-27 flow. Additionally, a switch guard was installed over the MEC #2 power 
toggle switch to preclude inadvertent action by the crew. An effort is underway to 
obtain a design solution to eliminate these failure modes from the system. 

To date, there have been no failures in the Orbiter and SRB RGA power circuits. 
There is also a low failure rate for critical power circuit components (i.e., remote 
power controllers and diodes). 
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RESOLVED STS-37 SAFETY RISK FACTORS 


ELEMENT/ 
SEQ. NO. 


INTEGRATION 
1 (Continued) 


RISK COMMENTS/RISK ACCEPTANCE 

FACTOR RATIONALE 


New Crit 1 and 1/R2 failure modes have 
been identified for the RGAs on the 
Orbiter and SRBs. 


Rationale for STS-37 flight was: 

• Redundant power circuits were tested during normal flow processing. 
Additional prelaunch tests were identified to verify the SRB RGA backup 
power logic source. 

• Reliability of RGA power circuit components is high. 

• Photographic documentation of critical connectors demonstrated proper 
connector installation. 

• Critical connectors were not demated since STS-27. 

• A switch guard was installed over the MEC #2 power toggle switch to 
preclude inadvertent actuation. 

This risk factor was acceptable for STS-37. 
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RESOLVED STS-37 SAFETY RISK FACTORS 


ELEMENT/ RISK COMMENTS/RISK ACCEPTANCE 

SEQ. NO. FACTOR RATIONALE 


ORB1TER 

1 


External Tank (ET) umbilical door lug 
clevis cracks on STS-37/OV-104. 

HR No. ORBI-302A {AR} 

No problems were experienced with 
umbilical door closure on STS-37. 
Pastfligfit visual inspection of 
STS-37/OV-104 ET door lug crevises 
found no apparent crack growth as a result 
of ET umbilical door closure operations on 
orbit. All OV-104 ET door lug housing? 
have now been replaced with the modified 
J-leg lug design- 


in' umbilical door lug clevis cracks and displacement observed on OV-103 have led 
to increased inspection and awareness on other Orbiters. Dye-penetrant and etch 
inspection of OV-104 revealed crack initiation on 3 of 4 lug clevises; the fourth 
clevis showed indications of pitting. Eddy current measurements of the cracks 
indicated a maximum depth of 0.025" ±0.005". No lug displacement was noted, and 
adjustments made to the door rigging during the STS-37 flow were considered 
unaffected by the presence of clevis cracks with the current flaw size. Discovery of 
these cracks on OV-104 was made after the ET umbilical doors were locked open 
on the centerline latches. Previous inspection of OV-104 lug clevises, with the ET 
umbilical doors at the 90° position, found indications of pitting only. 

Analysis conducted during the STS-39/OV-103 investigation determined that Low- 
Cycle Fatigue (LCF) coupled with a stress riser (radius) at the lug clevis could lead 
to initiation of small cracks in the clevis. Rockwell International (RI) and the 
Orbiter Project reverified this analysis following the discovery of cracks on OV-104 
and confirmed by stress analysis that the peak stress of 42.3 thousand pounds per 
square inch (ksi) occurs at the base of the lug during normal ground-processing 
door cycling when the doors are latched at the centerline. This peak stress level is 
in the LCF range for 7075-T73 aluminum, the lug material. An independent 
assessment conducted by Code QT/Vitro confirmed this conclusion and further 
indicated that as few as 250 ground-processing door cycles, and application of 
associated tensile and compressive loads on the lug clevis, were sufficient to cause 
crack initiation. 

Rl/Orbiter Project stress analysis of the starter cracks observed on OV-104 
indicated a resulting positive safety margin of 34% above the 1.4 structural Factor 
of Safety (FOS). This determination was made considering the presence of a clevis 
crack, 0.025" in depth, with 48.5-ksi peak stress applied to the clevis. A fracture 
analysis, also performed by Rl/Orbiter Project, indicated that the crack is stable in 
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RESOLVED STS-37 SAFETY RISK FACTORS 


ELEMENT/ RISK COMMENTS/RISK ACCEPTANCE 

SEQ. NO. FACTOR RATIONALE 


ORBITER 


1 (Continued) 


ET umbilical door lug clevis cracks on 
STS-37/OV-104. 


the current configuration. Predictions made using the fracture analysis model 
demonstrated that a 0.025"-deep clevis crack would be stable (defined as slow, 
subcritical crack growth) for more than 300 ground-processing load cycles (a load 
cycle is defmed as door swing from the open, latched position to the ready-to-latch, 
sag position). For the remainder of the STS-37 prelaunch activities and mission, the 
ET umbilical doors cycled once on orbit and were returned to the open, latched 
position for the ferry flight. 

Because repeated inspections using dye-penetrant and etching techniques were 
performed on OV-104 lugs, concern was raised relative to the potential for etchant 
entrapment in the crack leading to accelerated crack growth. Pasa-Jell 105, an acid 
etchant normally used for aluminum surface treatment for adhesive bonding, was 
used on the OV-104 lug clevises. Pasa-Jell 105 is comprised of sulfuric acid and 
sodium dichromate, and uses thixotropic as a thickening agent. This etchant has a 
gelatinous consistency and is viscous in nature. It is, therefore, not believed that the 
Pasa-Jell 105 could penetrate tight cracks such as those observed on OV-104 lugs. 
The subsequent applications of dye-penetrant fluid and saline solution, used to 
remove excess dye penetrant after inspection, are believed sufficient to flush out 
Pasa-Jell 105 residue if present. 

Sulfuric acid contribution to stress corrosion in 7075-T73 aluminum was evaluated. 
Sulfuric acid is often used to anodize aluminum and to prepare aluminum for 
bonding. There is no known history of aluminum stress corrosion from sulfuric acid 
exposure. The Orbiter Project, however, performedests on a 7075-T73 aluminum 
specimen with an induced crack and etched with Pasa-Jell 105 to verify the absence 
of stress corrosion. Preliminary results of these tests, provided on March 14, 1991, 
indicated no crack growth with cyclic application of compression and tension loads. 
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ET umbilical door lug clevis cracks on Code QT/Vitro performed an independent analysis of a 7075-T73 aluminum lug 

STS-37/OV-104. with a starter crack, similar to that observed on OV-104, to determine the rate of 

crack growth. The load applied to the lug for this analysis was 2300 pounds (lb), 
the load determined by the Orbiter Project that results from the maximum push-up 
load (210 lb) on the ET umbilical door to achieve centerline latch. The 210-lb 
push-up load was identified as the greatest force applied to the ET door, during all 
ground-processing and operational scenarios, that transfers the greatest tensile 
stress (2300 lb) to the lug clevises. Results of this analysis indicated that the 
existing cracks would not grow to critical size. Crack growth, under a worst-case 
load without further door cycling, was projected to grow at a rate of 3.5 x 10' 5 
inches per hour, or 0.035" over a period of six weeks. 

Consideration was given to the total OV-104 analysis effort by the Space Shuttle 
Program Management on March 6, 1991. The consensus of the community and 
Program Management was favorable, with the following exceptions: 

• The Kennedy Space Center (KSC) Safety Director recommended that the 
cracked lugs on OV-104 be replaced with new lugs from OV-105 prior to 
STS-37 flight. This action would leave no concern regarding the 
acceptability for STS-37 flight. 

• The Deputy Associate Administrator, Office of Safety and Mission Quality, 
accepted the findings of the analysis but recommended that a visual 
inspection (borescope) be performed prior to launch to verify that the 
clevis cracks had not grow. 

After consideration of these exceptions, the Space Shuttle Program Director made 
the decision to accept the residual risks associated with launching STS-37/OV-104 
with starter cracks in the lug clevises and to clear STS-37/OV-104 for flight. The 
Director decided that further visual inspection would not be required prior to flight. 
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ET umbilical door lug clevis cracks on The Space Shuttle SSRP and NASA Headquarters Safety Division, Code QS, also 

STS-37/OV-104. considered the results of the evaluation and the relative safety for STS-37 flight. 

The conclusions reached by the SSRP and Code QS are as follows: 

• There was an increased risk associated with launching STS-37/OV-104 with 
starter cracks on the ET umbilical door lug clevises. 

• OV-104 lug clevises should be visually inspected at the pad prior to launch 
to verify that the existing cracks had not grow or open, and displacement of 
the lug(s) similar to that seen on OV-103 did not exist. 

• Visual verification of the lug clevis cracks would increase confidence that 
analysis performed to date was accurate and that OV-104 was safe for 
flight. 

After careful consideration of these conclusions and the independent analysis 
performed by the Orbiter Project and Code QT, the Associate Administrator for 
the Office of Safety and Mission Quality accepted the residual risks associated with 
launching STS-37/OV-104 with starter cracks and determined that a visual 
inspection of the lug clevises was not necessary to clear STS-37/OV-104 for flight. 

It was reported that, during receiving inspection of OV-105 lugs scheduled for 
installation on OV-103, 1 of the 4 lugs was found with bdications of a starter crack. 
This crack was found through dye-penetrant and eddy-current testing. Indications 
were that the crack initiated through the same LCF phenomenon seen on the other 
Orbiters. This was attributed to the number of door cycles required to install and 
properly rig the OV-105 ET doors. Because of this finding, the decision was made 
to install the modified OV-102 lugs on OV-103 and to return the OV-105 lugs to RI 
for rework and modification. 
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ET umbilical door lug clevis cracks on While inspecting the OV-103 ET door assembly at RI, it was discovered that the 

STS-37/OV-104. splined shaft index mark was not correctly marked on the RH aft housing, resulting 

in the pushrod adjustment being adjusted to its full available travel. Inspection of 
the other 3 OV-103 ET door assemblies was performed. In addition, 2 of the 
OV-105 assemblies being readied for shipment to KSC were found with the splined 
shaft index marked 180 0 from the drawing requirement. The OV-105 shafts will be 
disassembled and fixed prior to shipment to KSC. OV-102 splined shafts were 
inspected and found to be correctly marked. These findings called into question the 
condition of the splined shafts and associated index markings on STS-37/OV-104. 
The OV-104 assemblies could not be examined in the current, staked position. 
However, RI verified that pushrod measurements were made and determined that 
critical shaft alignments were well within drawing tolerances. Additionally, rigging 
of both OV-104 ET doors was functionally verified by Operational Maintenance 
Requirements and Specifications Document (OMRSD) checkout procedures during 
the STS-37 flow. 

Rationale for STS-37 flight was: 

• The Space Shuttle Program Director and the Associate Administrator of 
the Office of Safety and Mission Quality accepted the residual risk 
associated with launching STS-37/OV-104 with starter cracks in the ET 
door lug clevises and decided that further inspection was not required prior 
to launch. 

• Results of the Orbiter Project specimen testing indicated that there was no 
crack growth in the presence of the Pasa-Jell etchant. 

• Verification of proper spline shaft alignment was accomplished. 

This risk factor was accepted for STS-37. 
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STS-39/OV-103 pilot-side Display Driver 
Unit (DDU) Attitude Direction Indicator 
(ADI) ball hesitation. 

No DDU ADI problems were reported that 
affected performance on STS-37. 


During Operational Sequence (OPS)-9 dedicated display dynamic drive testing on 
STS-39/OV-103, the pilot-side DDU ADI ball occasionally hesitated. Similar 
testing on the commander-side DDU found the ADI ball to work properly. The 
commander-side ADI was relocated into the pilot-side position, where it also was 
found to hesitate. The commander’s ADI was returned to the commander-side 
position and was found to operate correctly. The identical OPS-9 testing was 
performed on OV-104 with the same results; ADI ball hesitation occurred on the 
pilot side only. Subsequent testing at the Shuttle Avionics Integration Laboratory 
(SAIL) determined that this anomalous condition was demonstrated in the pilot and 
aft ADIs. Testing with both the new General Purpose Computers (GPCs) and new 
flight software, and the old GPCs and STS-35 flight software, gave the same results. 

This problem was traced to the DDU and the way it processes ADI data. It was 
determined that the DDU does not process the ADI ball data for one update cycle 
on an intermittent basis. This phenomenon occurs both in the OPS-9 dynamic drive 
tests on the ground and when using the OPS-O, -1, -2, -3, and -6 flight software. 
Troubleshooting and SAIL testing are continuing to further isolate the cause of this 
problem. Testing is also planned for OV-105. 

The STS-37 crew was informed of the problem, and this condition was 
demonstrated to them. The crew determined that this condition was acceptable for 
flight and would not adversely impede their performance. 
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STS-39/OV-103 pilot-side DDU ADI ball 
hesitation. 


Rationale for STS-37 flight was: 

• The ADI ball hesitation was demonstrated to the STS-37 crew and was 
determined not to impede performance. 

• There were no other known DDU processing anomalies in the new GPC 
OPS software. 

This risk factor was acceptable for STS-37. 


STS-37 /O V- 104 Auxiliary Power Unit 
(APU) #3, Serial Number (S/N) 307, 
uncommanded Gas Generator Valve 
Module (GGVM) Shutoff Valve (SOV) 
motion. 

HR No. ORBI-031 {AR} 

ORBI-184 {AR} 

No APU GGVM problems were reported 
on STS-37. 


APU #3, S/N 307, was installed on STS-37/OV-104 since the last flight. During 
APU fuel line high-point bleed operations, the injector temperature indicated an 
unexpected increase of 60 °F over a 24-minute (min) period. Review of the gas 
generator bed temperature data confirmed the temperature rise. Injector and gas 
generator bed temperature rise is a positive indication that fuel is reaching the bed. 
Troubleshooting isolated the cause to fuel leakage through the SOV. Movement of 
the SOV was confirmed by a fuel pump inlet pressure decrease and an exhaust duct 
pressure increase during the same 24-min period. A subsequent GGVM liquid leak 
check of the SOV valve was performed at 370 pounds per square inch absolute 
(psia), with no indicated leakage. This further confirmed that the SOV had moved 
slightly to the open position and had not leaked. Additional leak checks were 
performed at pressures between 20 and 100 psia to confirm low-pressure sealing. 
APU #3, S/N 307, was hot-fired at the pad prior to launch. Additionally, a final 
GGVM liquid leak check was performed at the pad to verily SOV integrity prior to 
launch. 


4-13 


STS-37 Postflight Edition 





RESOLVED STS-37 SAFETY RISK FACTORS 


ELEMENT/ 
SEQ. NO. 


QRBITER 
3 (Continued) 


RISK COMMENTS/RISK ACCEPTANCE 

FACTOR RATIONALE 


STS-37/OV-104 APU #3, S/N 307, The cause of the SOV valve opening is still unidentified. KSC documented this 

uncommanded GGVM SOV motion. problem as an unexplained anomaly to be resolved prior to STS-39 flight. 

Rationale for STS-37 flight was: 

• APU #3, S/N 307, was hot-fired at the pad to verify APU performance 
integrity. 

• OMRSD liquid leak checks were performed at the pad; this verified 
GGVM valve integrity prior to launch. 

This risk factor was resolved for STS-37. 


New Data Processing System (DPS) 
failure could lead to a Crit 1/1 condition. 

No similar anomalies were reported on 
STS-37. 


During testing in the SAIL on January 12, 1991, an operator noticed that the left 
keyboard entry was displayed simultaneously on Cathode Ray Tube (CRT) #1 and 
CRT #3. Because the select switch was in the CRT #3 position, the keyboard 
entry should have been displayed only on CRT #3. The operator cycled the select 
switch several times, and the problem was corrected. 
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New DPS failure could lead to a Crit 1/1 Troubleshooting determined that the anomaly could not be isolated to a hardware 

condition. problem because it repeated with different SAIL hardware. Potential hardware 

failure modes that could cause the same effects were identified: 

• CRT select switch, Part Number (P/N) ME452-0102-7201, contact short-to- 
ground or contact-to-contact short. 

• Data Entry Unit (DEU) receiver hybrid output fails low. 

There were no other relevant CRT select switch, P/N ME452-0102-7201, failures in 
the problem data base. A toggle switch anomaly similar to this failure occurred on 
STS-41 (see Section 6, Orbiter 4); however, the switch was a different dash number. 
The STS-41 anomaly was attributed to a particle large enough to cause a contact-to- 
contact short. There were 2 previous failures of DEU receiver hybrids, P/N 
6088602; however, both were due to manufacturing defects and were considered 
isolated occurrences. 

The existing switch FMEA lists this type of failure as Crit 1R3. This was based on 
2 keyboard entries causing an unpredictable Backup Flight System (BPS) 
pre-engage response during ascent and entry. An assessment of displays presented 
during nominal ascent and entry revealed no Specification (Spec)/keystroke 
combinations that could result in a Crit 1/1 scenario; therefore, the current FMEA 
was applicable. However, further assessment of all available vehicle displays 
identified several Spec and single or double keystroke execute combinations that 
could lead to a Crit 1 scenario. These displays would only be presented in 
off-nominal conditions. The CRT select switch FMEA was upgraded to a Crit 1/1 
CIL for STS-37. Additionally, there is a potential for a new Hazard Report to 
baseline the associated risks. 
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New DPS failure could lead to a Crit 1/1 Rationale for STS-37 flight was: 

condition. 

• The hardware involved, CRT select switch and DEU receiver hybrid, has 
demonstrated high reliability. 

• The potential for a Crit 1/1 failure exists only in off-nominal scenarios. 

• All Spec/keystroke combinations were identified. 

• The STS-37 crew was trained to check for keyboard entries displayed 
simultaneously on 2 CRTs when entering commands. 

This risk factor was acceptable for STS-37. 


Potential for new GPCs to erroneously 
overwrite memory. 

HR No. ORBI-194 (AR) 

No GPC problems attributed to erroneous 
memory overwrite were experienced on 
STS-37. 

The halt position in the AP-101S (new GPC) is known as the sleep mode. During 
the sleep mode, a minimum amount of power is applied to retain the memory 
(approximately 56 watts vs 560 watts nominal). Since the new GPC has a 
Complementary Metal Oxide Silicon (CMOS) memory that would be lost if power 
is removed, FR 7-30 B was added for this first flight of the AP-101S GPCs. 


At the Level III Orbiter Flight Readiness Review, IBM reported a generic hardware 
problem with the new GPCs. The problem occurred when the transition was made 
from halt (also known as sleep or freeze-dried mode) to an operational mode; the 
GPC could cause random locations of memory to be overwritten. The problem was 
first seen with the Shuttle Mission Simulator (SMS); however, it was initially 
believed to be unique to the SMS. A hardware design change was made to a single 
page in the GPCs to fix this problem. Access to the GPCs in the horizontal 
position is required to implement this change. 
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Potential for new GPCs to erroneously This FR states that "...Since removing power from the 101S GPC causes loss of 

overwrite memory. memory integrity, a 101S GPC will only be powered off under extreme power-down 

conditions." However, discovery of the new memory overwrite potential was a 
deterrent to putting 2 or 3 of the GPCs in the sleep or freeze-dried mode on orbit 
as was planned. 

The workarounds proposed for STS-37 included: 

• Keeping the GPCs in the standby mode, instead of the halt or sleep mode, 
so that a power transition is not required; or 

• Performing Initial Program Load (IPL) from the Mass Memory Unit 
(MMU) on any GPC undergoing power transition from the sleep mode 
(i.e., at power-up). 

The first workaround would eliminate the concern for memory overwrites but would 
consume more power than planned. It was planned to put 3 GPCs in the sleep 
mode when on orbit: the BFS computer and 2 of the 4 GPC redundant set. Only 2 
Primary Avionics Software System (PASS) computers are nominally planned to run 
on orbit to conserve power and enable the crew to "freeze-dry" the G2 [on-orbit 
Guidance, Navigation and Control (GN&C)] on 1 machine and the G3 (entry 
software) on the other "sleeping" machine. In the process used to freeze- dry an 
AP-101S GPC, the GPC is loaded with the desired software configuration (G2 or 
G3 in this case) and put into the sleep mode. The reason for freeze-drying is to 
have a copy of critical software available without requiring access to MMUs. 
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Potential for new GPCs to erroneously Human factors and timing are of concern to IPL at GPC power-up. While the IPL 

overwrite memory. is a viable workaround in any case, crew intervention is required for this 

workaround option. 

Because of this problem, a decision was made to configure the STS-37 GPCs on 
orbit as follows: 

• GPC 1 would have the on-orbit GN&C software. 

• GPC 2 would be put in sleep mode when not in use. The crew would 
power-up GPC 2 and perform an IPL to load the redundant GN&C 
software for the planned Gamma Ray Observatory (GRO) deployment 
operations on the third day. 

• GPC 3 would be freeze-dried for G3 and kept in the standby mode. 

• GPC 4 would have the Systems Management (SM) software. 

• GPC 5 was reserved for the BFS and would be put in sleep mode on orbit. 
The crew would perform an IPL to load the BFS for deorbiting operations. 

Rationale for STS-37 flight was: 

• A plan was in place to alleviate the need to power-down certain GPCs on 
orbit. 

• If unplanned or inadvertent power loss did occur, the crew could perform 
the required IPL to reconfigure the GPCs. 

This risk factor was resolved for STS-37. 
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Cabin pressure bleed valve anomalies on 
OV-105. 

HR No. ORBI-074 {C} 

No problems with cabin pressure bleed 
valves were reported on STS-37. 


Historical comparison of seal material batches to seal leakage indicated no 
definitive correlation. All seal materials are batch tested for correct material 
properties. 

For flight vehicles, cabin pressure bleed valve leak tests at 15 pounds per square 
inch differential (psid) are performed every 5 flights. Maximum allowed leakage is 
25 standard cubic centimeters per minute (seem). During countdown, cabin 
pressure drop is monitored, with a 2-psid gross leak limit. Each valve is checked 
individually after venting the cabin; there is no reverification of leakage. OV-103 
valves were last leak-tested before STS-41 with no problems noted. OV-104 valves 
were checked during the STS-37 flow with no anomalies. A requirement is in work 
to leak check OV-102 valves prior to STS-40. 


Three cabin pressure bleed valves installed on OV-105, S/N 5, 6, and 8, recently 
failed leak tests. A fourth, S/N 7, was inspected at the manufacturer, Charlton 
Technologies, Inc. (CTI), and was found to be leaking; however, the leak was within 
specification. All 4 valves exhibited signs of seal debonding. Valves S/N 1 through 
S/N 4 had no history of leakage or seal debond. The cause of the debonding was 
not determined. The bond could be affected by either a lack of primer on the valve 
or incorrect application of primer to the valve. Poor adhesion of S/N 5 through 
S/N 8 molded seals, and seal leakage, was verified at CTI. Testing was inconclusive 
in determining proper primer application. Records show that the seals were 
molded in accordance with the applicable procedure; however, there were no 
specific inspection criteria for primer application. 
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Cabin pressure bleed valve anomalies on 
OV-105. 


OV-104 wing strut tubes found damaged 
during STS-38 postflight inspection. 

HR No. ORBI-277 {C} 

No anomalies attributed to wing stmt tube 
problems were experienced on STS-37 after 
repair of the 2 dented tubes found during 
STS-37 preflight inspection. 


Rationale for STS-37 flight was: 

• OV-104 cabin pressure bleed valves passed all leak tests. 

• Launch Commit Criteria (LCC) and FRs were in place to account for valve 
leakage after turnaround testing. 

This risk factor was resolved for STS-37. 

Wing strut tube damage was discovered during STS-31/OV-103 postflight 
inspection. A strut tube in the OV-103 Left-Hand (LH) wing was found dented. It 
was later determined to have an undersized wall thickness of 0.014"; minimum 
required wall thickness is 0.018". Identification of this below-minimum wall- 
thickness condition triggered a fleetwide ultrasonic inspection of all wing strut tubes 
with a calculated margin of safety of 0.35 or less. OV-104 was determined to have 
2 struts below the minimum margin of safety in the Right-Hand (RH) wing and 2 in 
the LH wing; 2 of the 4 were determined to have a negative margin of safety. 
Doublers were installed to reinforce these 2 struts prior to STS-38/OV-104 flight. 

During preflight inspection of STS-37/OV-104, 2 strut tubes were found dented. 

The dented tubes were repaired using doublers (comprising hose clamps, EA934 
epoxy adhesive, and 0.020" clamshell). Post-repair proof-load tests were performed, 
and plans were developed to certify the strut tubes for multimission use; 
certification is currently limited to 1 flight. Note that, prior to STS-38, repair of 
undersized strut tubes was dispositioned as acceptable for unrestricted use; however, 
a recent evaluation determined that repaired tubes should be restricted to 1 flight. 
Because replacement truss tubes will not be available until June 1992, continued use 
of repaired truss tubes will be made on a flight-by-flight basis following proof-load 
testing. 
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OV-104 wing strut tubes found damaged Rationale for STS-37 flight was: 

during STS-38 postflight inspection. 

• Pre-STS-38/OV-104 wing strut tube inspection identified the location of all 
undersized tubes. Doublers were installed on 2 struts with a negative 
margin of safety, increasing the margin of safety to a positive level. 

• The 2 dented OV-1Q4 truss tubes found on January 31, 1991 were repaired 
and successfully passed proof-load testing. 

• Proof-load testing is required to clear repaired strut tubes prior to each 
flight. 

This risk factor was resolved for STS-37. 


New GPC, AP-101S, failure mode. 

No GPC problems were reported on 
STS-37. 


GPC S/N 507 failed during operation in the SAIL in June 1990. S/N 507 was 
reported to be unable to recover from the sleep mode. Power cycling of S/N 507 
restored the GPC to normal operation. This anomaly was reported on Corrective 
Action Report (CAR) #7274. S/N 507 was removed from the SAIL and returned 
to IBM for troubleshooting. 

Troubleshooting at IBM could not repeat the failure during vibration and thermal 
testing. IBM was also unsuccessful in isolating a failure using Automatic Test 
Equipment (ATE). The sleep mode logic was analyzed for a potential design flaw. 
This analysis resulted in identification of the design problem addressed in Section 4, 
Orbiter 5. Because no failure could be isolated at IBM, S/N 507 was returned to 
the SAIL and operated for over 500 hours (hr) without a repeat of the earlier 
failure. 
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New GPC, AP-101S, failure mode. A recent review of SAIL videotape showed that the S/N 507 mode switch was in 

the "run" position instead of the "sleep" position when the June 1990 failure 
occurred. This finding indicated the potential for a generic power supply problem 
in the AP-101S GPCs. S/N 507 will be returned to IBM for additional testing and 
troubleshooting that will focus on GPC power supply operation and functionality. If 
the failure cannot be duplicated or isolated at IBM, the S/N 507 power supplies will 
be removed from flight status. There have been 2 previous AP-101S power supply 
failures, both in qualification units. These 2 qualification failures had different 
causes and effects; both resulted in design or procedural fixes. 

Rationale for STS-37 flight with new GPCs was: 

• There was no failure history of new, flight-unit GPC power supplies. 

• New GPCs installed on OV-103 were extensively tested with no similar 
problems. 

This risk factor was resolved for STS-37. 


Indications of voids and debris found in 
review of STS-37/OV-104 Nose Landing 
Gear (NLG) holograms. 

HR No. ORBI-185 {C} 

No tire problems were experienced on 
STS-37/OV-104 subsequent to replacement 
of a defective RH NLG tire. 


Debris was found iu an STS-39/OV-103 NLG tire. Holograms of all fleet NLG 
tires were reviewed, and all NLG tires in inventory at KSC were x-rayed for debris. 
Holography techniques are used to inspect NLG tires, and the combination of x-ray 
and holographic inspection should find any abnormalities. The RH OV-104 NLG 
tire holograms indicated a void in the sidewall. No discrepancy was written at the 
time that the original hologram was evaluated; however, the inspector did indicate 
the presence of the void in the inspection report. The OV-104 RH NLG tire was 
replaced with a spare that passed holographic and x-ray inspection. 
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Indications of voids and debris found in Holograms of the LH OV-104 NLG tire indicated that it had no voids or debris, 

review of STS-37/OV-104 NLG Recent x-ray inspection of this tire found an indication of a piece of wire in the tire 

holograms. carcass measuring 0.1“ in length and 0.02" in diameter. This finding, however, was 

not made until after the STS-37/OV-104 NLG wheel well was closed out for flight. 

The debris problem appears to be generic because 11 of 19 tires recently x-rayed 
showed signs of embedded debris. A review of the operational history of the 
11 NLG tires found with debris indicated that 3 tires had flown five missions with 
embedded debris; 2 of the 3 had flown 2 missions each. Debris found in the 
OV-104 LH NLG was smaller than debris found in the 3 flown tires. There were 
no failures or anomalies in the Space Shuttle Program flight history. Based on this 
history, and the fact that NLG tires have performed well with embedded debris, it 
was believed that the debris in the OV-104 LH NLG would not lead to tire failure. 
This tire was removed from the inventory upon return of STS-37/OV-104. 

Rationale for STS-37 flight was: 

• The OV-104 RH NLG tire was found to have no voids or debris. 

• Based on fleet history of NLG tires flown with embedded debris, the debris 
found in the OV-104 LH NLG would not lead to tire failure. 

This risk factor was acceptable for STS-37. 
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A Main Propulsion System (MPS) 3-way 
helium solenoid valve failed leak tests on 
OV-102. 

HR No. ORBI-108E {AR} 

ORBI-129A {C} 

No MPS helium leaks were experienced on 
STS-37. 


MPS leak tests on OV-102 after the STS-35 flight isolated a leak to a 3-way helium 
solenoid valve, LV68, that is used in the 17" disconnect latch unlock. Additional 
tests confirmed the leak and further isolated it to a crack in the valve bellows. 
Similar 3-way helium solenoid valves are used in 46 locations in the MPS. The 
valves control helium pressure to open or close pneumatically-operated MPS valves. 
The concern here was that a worst-case failure of a helium valve could lead to 
helium leakage or valve rupture and result in a Crit 1 failure. This failure scenario 
was believed to potentially deplete the onboard helium supply, resulting in the 
inability to close prevalves at Main Engine Cutoff (MECO) and the potential for 
Main Engine (ME) turbopump overspeed and explosion. LV68 was removed for 
evaluation and replaced. Retests indicated that the replacement valve was not 
leaking. 

Helium solenoid valve bellows are 2-ply (nickel and copper plies) and are fabricated 
by an electrofonning/ electroplating process. Convoluted plies are soldered to end 
fittings to complete the bellows assembly. In normal operation, the valve bellows 
assembly is pressurized by solenoid inlet pressure. Internal bellows pressure and 
spring rate provide the forces necessary to maintain the valve in the closed position 
when the solenoid is deenergized. Bellows assemblies are proofed at 1550 pounds 
per square inch (psi), more than twice the operating pressure. Bellows assemblies 
are reproofed after solder rework; therefore, a valve could be subjected to multiple 
proof-pressure tests. 

Initial teardown and inspection of the failed LV68 valve identified a deformation, or 
squirm, in the bellows that was caused by buckling instability. Further examination 
found a circumferential crack on the bellows convolute crown. The crack was 
approximately 0.150" in length and was on the tension side of the squirm. Leak 
checks measured the leak rate to be 22 standard cubic feet per minute (scfm) 
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An MPS 3-way helium solenoid valve at 300 psi. Extrapolation to 750-psi operating pressure predicted a leak rate of 

failed leak tests on OV-102. 54 scfm. The maximum leak allowed is 10 standard cubic centimeters per second 

(sees) from the valve vent port. 

Metallurgical analysis determined that the crack was 80% through the inner bellows 
ply and was due to fatigue. Final separation in each ply was determined to be due 
to overload. The crack did, however, coincide with a small void in the copper 
strike. Other cracks were discovered in adjacent convolutes. These cracks 
propagated from the inner diameter toward similar voids in the copper strike. 
Vendor stress analysis indicated that the bellows design was marginal for the 
1550-psi proof test. Predictions were that the internal pressure required to initiate 
squirm deformation is 1551 psi. A more conservative analysis indicated that the 
pressure needed to initiate squirm is much lower than 1500 psi. The potential 
effects of a squirmed bellows on valve operation was evaluated. 

The investigation into this failure considered the potential for a lot-related failure 
mode. The failed bellows was manufactured in 1987 in a lot of 7 bellows, a start-up 
lot after a 5-year layoff. Records indicated that the failed bellows, and all other 
bellows in the lot, had been subjected to 3 proof tests because of required solder 
rework. A second bellows from the lot of 7 is installed in the Liquid Oxygen side 
outboard fill and drain valve on OV-103. The outboard fill and drain valve on 
OV-103 will be replaced prior to STS-39 flight. Of the 5 remaining bellows from 
the lot, 4 were scrapped and the fifth was rejected at KSC after the valve failed 
helium signature tests. This valve also showed signs of squirming. 

The investigation also determined that solenoid valve certification tests were 
inadequate for verifying bellows life. Certification testing included 12,000 valve 
operation cycles; however, only 50 pressure cycles were performed. Pressure cycling 
is believed to be the primary contributor to bellows squirming and fatigue. 
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An MPS 3-way helium solenoid valve No other solenoid valve bellows failures were recorded during flight or ground 

failed leak tests on OV-102. checkout. This history includes a significant number of valve cycles and operations. 

Bellows problems were, however, encountered during the production of the OV-105 
bellows assemblies in 1989. In this case, initial production runs were scrapped. 
OV-105 bellows failures were not the result of cracked bellows; however, the 
bellows were found squirmed and dimensionally unstable after repeated proof- 
pressure tests. All OV-105 bellows were reworked because of solder problems 
induced by numerous process and personnel deficiencies at the vendor. 

Prelaunch and operational procedures are in place to control potential helium leaks 
through the valve bellows. Prior to launch, excessive helium loss is detected by the 
Hazardous Gas Detection System (HGDS) and, if aft compartment helium 
concentrations exceed the 10,000-parts per million (ppm) LCC limit, the launch is 
scrubbed. After launch, helium tank pressures are monitored by the Caution and 
Warning System (CWS). An alarm sounds if helium tank pressures drop below 
3800 psi. If this occurs during ascent, the crew is required to manually close 
isolation valves LV7 and LV8 to conserve helium. LV7 and LV8 would be 
reopened along with LV10 (engine crossover) at MECO minus 30 sec. These 
actions are intended to conserve sufficient helium stores to enable engine prevalve 
closure at MECO. 

Analysis performed by Johnson Space Center (JSC) determined that the worst-case 
inflight leakage due to a ruptured bellows is manageable. The leak rate, restricted 
by a 0.0930" diameter passage in the valve, was calculated to be 260 scfm. This leak 
rate would not deplete the helium supply during ascent; therefore, sufficient helium 
would remain in the system to shut engine prevalves at MECO. Additionally, a 
260-scfm leak would not provide sufficient helium to overpressurize the aft 
compartment. 
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An MPS 3-way helium solenoid valve Rationale for STS-37 flight was: 

failed leak tests on OV-102. 

• The 3- way helium solenoid valves had a highly reliable history prior to the 
cracked bellows found on OV-102. This history included 46 valves installed 
and operated on 37 Space Shuttle missions. 

• There were no bellows from the suspect lot installed on OV-104. 

• Processing flow leak checks and prelaunch HGDS monitoring have the 
capability to identify leaks. If a leak were to occur after launch, CWS 
monitoring would ailert the crew to take action to conserve the helium 
supply. 

This risk factor was acceptable for STS-37. 


Gaseous Hydrogen (GH^ Flow Control 
Valve (FCV) weld crack found on 
OV-103. 

HR No. ORBI-306 {AR} 

No GH 2 FCV problems were experienced 
on STS-37. 


During STS-39/OV-103 preparations, a small leak was detected at the engine #1 
GH 2 FCV housing during mass spectrometer leak tests of the OV-103 GH 2 
pressurization system. These tests were performed as part of the investigation into 
the high Hydrogen (H 2 ) concentration measured in the OV-103 aft compartment 
during STS-41 ascent. The leak was measured at 2.3 x 10" 6 sees, in excess of the 
1 x 10^ sees specification limit. Initial calculations indicated that this leak rate was 
significant enough to account for the H 2 concentrations measured during STS-41; 
however, a more formal calculation of potential leak rates was performed. Analysis 
indicated that a worst-case leak through a circumferential crack would not provide 
sufficient H 2 to reach aft compartment flammability concentrations. Initial 
examination of the FCV found the leak source to be a 3/8" crack in the housing 
outlet tube weld. This weld is a sealing weld only and provides no structural 
integrity. 
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GH 2 FCV weld crack found on OV-103. Examination of the cracked FCV housing outlet tube weld at RI indicated that weld 

quality was good (good penetration, no evidence of material defect, and good weld 
blend). Structural analysis determined the failure mechanism to be High-Cycle 
Fatigue (HCF). The source of the fatigue has not been determined; however, loads 
induced in the high-vibration environment is the leading candidate. Investigation 
into potential vibration sources is underway. Evaluation of GH 2 and Gaseous 
Oxygen (G0 2 ) qualification FCV housings for similar fatigue conditions is in work. 
Leak tests and Nondestructive Evaluation (NDE) methods will be employed on the 
qualification housings. 

Visual inspection of OV-104 FCV outlet tube welds by MPS engineers did not 
reveal signs of cracks. OV-104 FCV housings had flown only 7 flights; the OV-103 
FCV housing with the weld crack was the fleet leader with 11 flights. Mass 
spectrometer leak checks were performed; no problems or out-of-specification leaks 
were found. 

Rationale for STS-37 flight was: 

• Mass spectrometer and visual inspections found no indication of leaks in 
OV-104 FCVs. 

• A worst-case circumferential crack would not provide sufficient H 2 to reach 
aft compartment flammability concentrations. 

This risk factor was resolved for STS-37. 
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Clogged APU #3 lube oil filter on 
OV-104. 


HR No. ORBI-036 {AR} 

ORBI-121 {AR} 

STS-37/OV-104 System #3 APU/Water 
Spray Boiler (WSB tube oil temperature 
run cooler than the other 2 systems. 

HSB #3 overcooling was experienced both 
post-MECO and during entry (IFA No. 
STS-37-V-12). This anomolous WSB 
operation was believed to be due to lube 
oil wax contamination. The problem was 
probably exacerbated by the inability to 
perform a hot-oil flush of contamination 
from APU #3 at the pad prior to launch. 


Anomalous operation was also experienced 
on WSB #2 during STS-37 ascent ; 

WSB #2 failed to cool APU #2 (IFA No. 
STS-37-V-B2). The cause was attributed to 
freezing of the spray bar due to wax 
buildup in WSB #2 Investigation into 
APU /WSB combinations that displayed 
similar problems is in work. 


During hot-fire of APU #3, S/N 307, at the pad, gearbox lube oil pressure peaked 
at 108 psia. High gearbox pressure is an indication of the presence of wax buildup 
and the potential for a clogged filter. Gear box pressure is nominally 50 psia during 
APU operation. A clogged filter could cause WSB spray bar freeze-up and an 
over-temperature condition of the APU post-MECO. Wax, in the form of 
pentaerythritol, is formed when APU hydrazine fuel reacts with APU lube oil. 
Pentaerythritol has 2 basic constituents: a soft, waxy-type substance and crystals. 

The waxy substance and crystals melt in the lube oil when temperatures exceed 
200*F. 

Several sources of contamination are possible. The most likely source is leakage 
across the fuel pump seal. During recent GGVM liquid leak checks on OV-104, 
fuel pump seal leakage was indicated by a decrease in the fuel pump inlet pressure 
and an associated increase in the seal cavity pressure. Another potential source of 
the wax contamination is the open loop hot-oil flushing procedure recently 
performed on WSB #3. A temperature of at least 250 "F is required to flush wax 
from the WSB tube bundle. The open-loop technique flush temperatures only 
reach 150 °F. As a result of using this flush procedure, contamination from the 
WSB tube bundle could have been deposited on the lube oil filter. Both APU #3 
and WSB #3 were considered contaminated with wax. 

The OMRSD requires a hot-oil flush if evidence of filter clogging is present. 
However, an APU hot-oil flush has never been performed in the vertical position; 
an OMRSD procedure would have to be written to accomplish the flush. The 
decision was made to drain the lube oil from APU #3 and replace the lube oil 
filter. 
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Clogged APU #3 lube oil filter on Examination found approximately 7 grams of crystalline pentaerythritol clogging the 

OV-104. filter; experience shows that 2 to 3 grams of normal debris trapped in the filter 

would cause lube oil pressures to exceed 50 psi. APU #3 and WSB #3 were still 
considered to be contaminated after replacement of the lube oil and filter because a 
hot oil flush was not performed. An OMRSD waiver was approved to acknowledge 
this condition, which has the potential for decreasing WSB #3 efficiency and could 
result in freeze-up of the WSB spray bar. 

Rationale for STS-37 flight was: 

• APU #3 lube oil and filter were replaced. An OMRSD waiver for non- 
performance of the hot-oil flush was approved. 

• For a nominal ascent, contamination is not a concern. 

• LCC limits gearbox pressure to 110 psia prior to launch. 

This risk factor was acceptable for STS-37. 
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Debris found in STS-37/OV-104 
window #1. 

HR No. ORBI-208 {AR} 

ORBI-339 {AR} 

No further window problems were 
experienced on STS-37 after replacement of 
the window #J thermal pane. The RTV 
debris found during prelaunch inspection at 
the pad did not affect window #1 cavity 
venting during ascent or entry. 


During STS-37/OV-104 window inspection at the pad, 3 small pieces of Room- 
Temperature Vulcanizing (RTV) were found between the outer thermal pane glass 
and the inner pressure pane glass. The largest piece of RTV was estimated to be 
3" long and 1/4" wide. The debris was located on the ledge between the outer 
thermal pane and the inner pressure pane. No debris was witnessed in the window 
cavity vent area. The concern was that the debris could block the window cavity 
vents during either ascent or descent. 

The window #1 thermal pane was replaced during the STS-37 flow because of 
damage determined to be greater in depth than allowed by specification. After 
installation of the new thermal pane, inspection was performed in the horizontal 
position, and no debris was identified. The debris found during the inspection at 
the pad most likely shifted when OV-104 was taken to the vertical position. 

Analysis determined that there was no mechanism (i.e., air flow out of the cavity or 
vibration) that would move the existing debris to the ascent vent. Gravitational 
forces induced during ascent would force the debris to remain in its current 
position. On orbit, the debris has the potential to migrate freely, however, this is 
not expected to cause visibility impairment or other problems. Air flow through the 
descent vent is into the cavity. If the debris migrates to the descent vent while on 
orbit, it is not of sufficient size to overcome the air flow and block the vent. 

Rationale for STS-37 flight was: 

• Through analysis, the debris was not expected to migrate to the window 
cavity vents during ascent. Air flow into the cavity during descent would 
move the debris away from the descent vent. 

This risk factor was acceptable for STS-37. 
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High-Pressure Oxidizer Turbopump 
(HPOTP) first-stage turbine disc 
cracking. 

HR No. ME-C1 (All Phases) {AR} 

No SSME anomalies were reported on 
STS-37. 


Dye-penetrant inspection of 4 HPOTP first-stage turbine discs identified radial 
cracks in the interstage pilot rib. Gradient oxide discoloration was found in 2 
cracks. These cracks were not detected or obvious prior to removal of the gold 
plating. The high-time HPOTP, where the cracks were first found, was the fleet 
leader with 21,908 sec and 52 starts. It had been removed from the flight program 
for a long time. Seventeen turbine discs were inspected to date; 7 were found with 
radial cracks in the interstage pilot rib. 

Materials and Processing (M&P) analysis determined that the cracks initiated 
midspan in the disc and extended either to the outboard or inboard corner of the 
pilot rib. Scanning Electron Microscope (SEM) inspection of the fractures 
indicated a brittle crystallographic appearance. The fracture mode showed the 
effects of H 2 influence, indicating probable LCF or sustained load crack 
propagation. Structural analysis indicated a cyclic strain range, overwhelmingly 
dominated by thermal shock at shutdown, caused by H 2 cooling of the hot disc. 

Peak strain was determined through tests to follow a minimum of 40 to 100 sec of 
operation, or when the disc reaches steady-state high operational temperature. 
Evaluation of the correlation of LCF analysis to this failure mode indicated that the 
worst-case thermal shock strain range was insufficient to result in cracking without 
H 2 embrittlement. 

Deviation Approval Request (DAR) #2474 for fatigue damage ratio was 
reevaluated for STS-39/OV-103 HPOTP first-stage turbine discs. To date, the 
lowest damage ratio for a disc found with radial cracks was 1.0. All previously 
flown discs had a damage ratio margin >4. This was true for 2 of 3 discs on 
STS-39. However, the damage ratio of turbine disc S/N 2702270, engine #2026, 
HPOTP #2226R3, was calculated to be 0.258 post-STS-39 flight. Because this was 
below the damage ratio margin of 4, the DAR #2474 limit was increased to allow a 
postflight damage ratio of 0.27. This action cleared turbine disc S/N 2702270 for 
flight. 
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HPOTP first-stage turbine disc cracking. The continued evaluation of the DAR limit for turbine discs on STS-37 and future 

missions led to an additional change in the criteria. Rocketdyne updated the 
previous DAR to deal with HPOTP turbine disc cracking by utilizing a statistical 
analysis method rather than the damage fraction method. This revision changed the 
DAR criteria from 0.27 damage fraction in the interstage seal pilot rib location to a 
life-limit of 14 starts (the HPOTP/turbine disc must be operated in excess of 20 sec 
to be counted as a start). This DAR life limit is based on a fleet leader approach 
used for other SSME components. The 14-start life limit is half the lowest number 
of starts (29) for a turbine disc found with cracks. Fleet history showed 44 discs 
with greater than 14 starts, and 24 discs with greater than 28 starts. Discs examined 
to date with 12, 15, 18, and 19 starts showed no cracks. Turbine discs in 
STS-37/OV-104 HPOTPs had no more than 11 starts. 

Rationale for STS-37 flight was: 

• HPOTPs on OV-104 did not exceed the 14-start DAR limit for STS-37. 

• Fleet history encompassed all significant LCF variables. 

This risk factor was acceptable for STS-37. 
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SSME 

2 


Suspected contamination of engine #2029 
HPOTP. 

HR No. ME-C1 (AU Phases) (AR) 

No SSME anomalies were reported on 
STS-37. 


During leak test operations on STS-39/OV-103 engine #2029 in the Orbiter 
Processing Facility (OPF), the potential existed for introducing contamination into 
the engine’s HPOTP. It was determined that an improper Ground Support 
Equipment (GSE) configuration was used for the leak test. As part of the MPS 
leak tests, tygon tubing from the Captive Air Vent (CAV) system is attached to the 
HPOTP intermediate seal drain line to vent helium outside the OPF in order to 
lower the helium background level. Upon disconnect of the tygon tube, positive 
pressure was observed flowing from the CAV tube in the form of a mist (visible 
air). The visible air was originally reported to be a hydraulic fluid mist. The 
potential also existed for introducing contamination into STS-37/OV-104 engines 
during STS-38 and STS-41 postflight drying operations. 

Swab samples were taken from STS-37 engines prior to installation. Engines #2019 
and #2107 were found acceptable. Initial samples from engine #2031 indicated the 
presence of 1.8-2.3 milligrams per square foot (mg/ft 2 ) of hydrocarbons; the limit is 
1.0 mg/ft 2 . Further samples taken from engine #2031 were analyzed and found to 
be good. The Liquid Oxygen (LOX) drain lines were removed from engine #2031, 
flushed with freon, and sampled. The results of the post-flush samples were good, 
and the drain lines were reinstalled. 

Rationale for STS-37 flight was: 

• Any contamination introduced into the HPOTP or engine would be 
detected in the swab sample testing; none was detected in engines #2019 
and #2107. Contamination found in engine #2031 was flushed out. 

This risk factor was resolved for STS-37. 
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Pogo standpipe thermal insulator may 
have been inadvertently removed during 
final engine assembly. 

HR No. INTG-005 {C} 

No SSME anomalies were reported on 
STS-37. 


Rocketdyne recently disclosed that an engine assembly mechanic stated that he 
removed the thermal insulator (teflon sleeve) from the pogo standpipe on engines 
#2028 and #0215. The mechanic stated that he thought the sleeve was a shipping 
protector. Subsequent inspection of the pogo standpipe on engine #0215 confirmed 
that the teflon sleeve was not present. Early pogo system development tests 
demonstrated the need for the standpipe thermal insulator to prevent Gaseous 
Oxygen (GOX) from condensing on the cold standpipe surface. Thermal analysis is 
underway to determine the delta temperature of the standpipe surface with and 
without the teflon insulator. 

Because of this finding, inspection of the STS-37 engine pogo standpipe was 
required. Pogo standpipe insulation was visually verified to be in place on all 
STS-37/OV-104 engines. 

This risk factor was resolved for STS-37. 


Potential for pad abort caused by purge 
check valve seat leakage. 

HR No. ME-A1S Rev. F 

No SSME anomalies were reported on 

STS-37. 


During a test firing of engine #0213 at Stennis Space Center (SSC), excessive Main 
Combustion Chamber (MCC) dome purge check valve leakage resulted in violation 
of the 50-psia ignition confirmation redline; the engine shut down. Post-test 
investigation determined that the check valve leakage was caused by an Inco-718 
particle lodging on the valve seat. The particle, 0.054" x 0.040" x 0.02", resulted in a 
leak through the valve of 11.5-12.5 scfm at 25 pounds per square inch gage (psig). 
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Potential for pad abort caused by purge No similar leakage had been recorded in the flight program (132 engine starts), 

check valve seat leakage. including 108 oxidizer purge check valves. However, this was the sixth occurrence 

during the ground test program (1808 tests). Records indicated that 2 cases were 
caused by Kel-F contamination from the MCC dome purge pressure actuated valve 
(which led to a pressure-actuated valve redesign), 2 were caused by contamination 
originating external to the engine, and the last from contamination of an 
undetermined source. In the most recent case, the source of the Inco-718 particle is 
unknown. Inco-718 is used in the helium precharge valve housing and the fuel 
preburner purge pressure actuated valve. The particle found did not resemble a 
machining chip or burr. The helium precharge valve was installed on test 904-087, 

3 tests prior to the most recent engine #0213 test. The purge line was disconnected 
at the helium precharge valve during HPOTP replacement. 

Rationale for STS-37 flight was: 

• Existing SSME assembly/disassembly procedures at KSC protect the 
engines from contamination entry. All joints are cleaned before 
disassembly, and open ports are covered with Aclar film and polyethene 
foam. 

• OV-104 SSME check valves successfully passed reverse seat leak checks 
after the last engine hot-fire. 

• There were no similar occurrences affecting the redline margins. 

• Worst-case failure is a pad abort. 

This risk factor was resolved for STS-37. 
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SSME 

5 


Potential for loss of SSME controller 
redundancy. 

HR No. INTG-165 {C} 

No SSME anomalies were reported on 
STS-37. 


During flight readiness testing of STS-37/OV-104, engine #2031, SSME controller 
Unit Number (U/N) F27, channel B halted when powered up. Analysis of the 
controller memory dump indicated an echo check failure after loading of the 
channel B output electronics storage register. A change in the storage register is 
indicative of a hardware failure. Repeated attempts to reproduce this failure were 
unsuccessful. U/N F27 was removed from engine #2031 and replaced with 
U/N F29. This was the fifth storage register failure detected during ground 
checkout. There had been no storage register-related failures during SSME starts 
for flight. The worst-case failure of this type is loss of SSME controller 
redundancy. If this was to occur between SSME start and SRB ignition, the result 
would be a pad abort. 

U/N F27 was returned to Honeywell, the vendor, on January 31, 1991. Upon initial 
powerup, the failure repeated. However, it did not repeat during subsequent cold 
starts, thermal cycles, or vibration testing. Additional destructive analysis was 
planned. 

Rationale for STS-37 flight was: 

• U/N F27 was replaced with U/N F29; no additional anomalies were 
experienced. 

• Checks at T-34 hours prior to launch verified all SSME controller 
hardware functions. 

• There have been no related failures during SSME starts at launch. 

• Worst-case failure would be loss of SSME controller redundancy. 

This risk factor was resolved for STS-37. 
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HPOTP second-stage turbine blades 
found rubbing coolant jet tubes on 
U/N 6009. 

HR No. ME-C1A Rev. F {AR} 

(All Phases) 

No SSME anomalies were reported on 
STS-37. 


Normal disassembly of HPOTP U/N 6009 found that the second-stage blades 
rubbed 3 of 19 coolant jet tubes. Approximately 0.012" was removed from the 
rubbed tubes. There was believed to be no structural damage, and no effect on 
performance was experienced. Only minor damage to the blade shank was noted. 
SEM inspection of the blade found random surface cracks up to 0.005" long. 
Comparable cracks are usually experienced with the normal casting process. These 
cracks were not detectable with optics or IVc penetrant. 

There have been multiple cases of second-stage turbine blades rubbing. Minimum 
clearance occurs between the disc stiffening rib and the turbine housing during the 
shutdown transient. The original height of the jets was a maximum of 0.012" above 
the print dimension. Worst-case interference with the jet is 0.014"; this would be 
detected by turbine shaft micro-travel inspection. Structural analysis indicated 
adequate margin with the presence of rubbed blades. 

Rationale for STS-37 flight was: 

• Blade rubbing was considered benign; damage to the second-stage turbine 
blades was acceptable. 

• Cracks observed on U/N 6009 were less than the dynamic threshold flaw 
size. 

This risk factor was acceptable for STS-37. 
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Engine #02X3, G-15 seal failed during 
ground testing at SSC. 

HR No. ME-D3C Rev. F {AR} 
ME-D3M Rev. F {AR} 

No SSME anomalies were reported on 
STS-37. 


During scheduled inspection of the MCC and nozzle on development engine #0213 
at SSC, the G-15 seal was found cracked and buckled. This seal had been in place 
for 34 tests and 15,114 sec of operation. Nozzle 4011 on engine #0213 
encompassed the maximum effective protrusion in the fleet. It had been removed 
from flight status because it exceeded the DAR limit. No leaks through the G-15 
seal were evident during pre- and post-test leak checks. Bluing and cracking of the 
G-15 seal was expected prior to nozzle removal based on extended monitoring of 
deteriorating or missing Flow Recirculation Inhibitor (FRI), but not to the extent 
witnessed on disassembly. Seal cracking and erosion are the result of hot-gas 
ingestion into the G-15 cavity. Diversion of hot-gas flow into the G-15 cavity 
requires large physical tube protrusions or hydraulic protrusion from multiple- 
vented tubes or eroded tube crowns. These protrusions are considered outside of 
the DAR limit. 

All STS-37/OV-104 SSMEs were verified not to have coolant tube erosion or 
vented tubes. There was no degradation or missing FRI on any OV-104 nozzle. 
Tube protrusions and hot-fire time on STS-37/OV-104 engines were well within 
DAR limits. The G-15 seals were leak checked since the last engine hot-fire. 

Rationale for STS-37 flight was: 

• Conditions surrounding the G-15 seal on engine #0213 were known and 
were outside established DAR limits for flightworthy SSME components. 

• STS-37/OV-104 G-15 seals were leak checked. 

• Components on STS-37/OV-104 SSMEs were well within DAR limits. 

This risk factor was resolved for STS-37. 
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RESOLVED STS-37 SAFETY RISK FACTORS 


ELEMENT/ 
SEQ. NO. 


SRB 


1 


RISK COMMENTS/RISK ACCEPTANCE 

FACTOR RATIONALE 


SRB APU speed trace anomaly during 
Acceptance Checkout (ACO). 

HR No. A-20-16 Rev. C-DCN3 {C} 
B-20-22 Rev. B-DCN3 {C} 

No problems were experienced with SRB 
APUs on STS-37. 


Post-hot-fire data review of APU S/N 155 during ACO for STS-48/BI-047 SRBs at 
United Space Boosters, Inc., (USBI) found that the GSE speed trace indicated 
anomalous data during APU turbine wheel spindown. The speed trace anomaly 
occurred between 29,000 and 21,000 revolutions per minute (rpm) for approximately 
1 sec. Anomalous indications were on the Magnetic Pickup Unit (MPU)-l GSE 
data trace. Two MPUs per APU provide speed indication to the SRB Integrated 
Electronics Assembly (IEA) via the APU controller to monitor and control turbine 
underspeed and overspeed conditions. In this instance, the anomaly was not, and 
would not be, detected by the IEA because the APU controller shuts down when 
the APU turbine wheel is at 40,000 rpm. Loss of signal from either MPU prior to 
T-0 results in a launch scrub/abort. Loss of MPU-1 signal during flight results in 
high-speed APU operation under the control of MPU-2 at 112%. Loss of MPU-2 
signal during flight results in loss of valve redundancy on that APU. 

Electrical isolation tests of the control circuit and GSE were performed; no 
anomalies were identified. GSE self-tests and tests on the SRB side of the interface 
were performed with no problems. A second APU hot-fire was performed, and the 
anomalous speed traces recurred. A third hot-fire test was performed with the 
MPU-1 and MPU-2 output cables swapped at the APU. During the third test, 
anomalous speed traces remained with the MPU-1 output in the GSE circuit only. 

In this case, however, anomalous MPU-1 speed traces were witnessed during both 
APU startup and spindown. APU S/N 155 was removed from BI-047 and sent to 
Sundstrand, the vendor, for further analysis. Subsequent hot-fire tests with APU 
S/N 132 installed were successful, exonerating the APU controller, signal 
conditioner, Multiplexer-Demultiplexer (MDM), flight cables, and GSE from 
suspicion. 
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RESOLVED STS-37 SAFETY RISK FACTORS 


ELEMENT/ 
SEQ. NO. 


SRB 

1 (Continued) 


RISK COMMENTS/RISK ACCEPTANCE 

FACTOR RATIONALE 


SRB APU speed trace anomaly during At Sundstrand, proper installation of the speed sensor assembly connector and 

ACO. MPU continuity, resistance, and insulation resistance were verified to be good. 

Review of APU S/N155 acceptance test history found no anomalies. A non-hot-fire 
turbine spin of APU S/N 155 was performed with Gaseous Nitrogen (GNj); no 
MPU-1 or MPU-2 output data problems were experienced. A hot-fire test was 
performed on March 12, 1991, and again no anomalies were recorded. Data from 
the hot-fire test at Sundstrand were considered to be of higher fidelity than data 
recorded during a hot-fire test at USBI. The high-fidelity data were taken to USBI 
and run through the ACO instrumentation to determine if the original problem was 
there. Teardown inspection of APU S/N 155 components was completed with no 
problems found. 

Rationale for STS-37 flight was: 

• This anomaly was screenable at ACO; STS-37/BI-042 APU-ACO data 
indicated no anomalies. 

• Loss of MPU signal prior to T-0 results in a launch scrub/abort. 

• Loss of signal in either MPU results in a fail-safe condition. 

• The APU S/N 155 anomaly did not manifest at nominal turbine speeds, 
only at startup and spindown. 

This risk factor was acceptable for STS-37. 
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RESOLVED STS-37 SAFETY RISK FACTORS 


ELEMENT/ 
SEQ. NO. 


SRB 

2 


RISK COMMENTS/RISK ACCEPTANCE 

FACTOR RATIONALE 


Thrust Vector Control (TVC) hydraulic 
reservoir found with 1/4" nut wedged 
between piston and cylinder head. 

HR No. B-20-20 Rev. C {C} 

B-20-21 Rev. B-DCN6 {C} 

No TVC problems were experienced on 
STS-37. 


During disassembly of a hydraulic reservoir at USBI Florida Operations, a 1/4” nut 
was found wedged between the piston and the low-pressure cylinder head. The nut 
was similar to that used extensively in the aft skirt; 2 are located on a tube bracket 
installed directly above the reservoir. During reservoir installation, the Operation 
and Maintenance Instruction (OMI) prohibits removal of reservoir plugs until tube 
installation is complete. The nut was covered by a black, soot-like coating similar to 
that seen in the aft skirt post-SRB fire. Initial assessment by USBI determined that 
the 1/4" nut could have entered the reservoir when it was removed from the STS-28 
SRB, the last mission that the reservoir was used. Examination of the nut also 
found signs of previous torque history. 

Hydraulic reservoirs, along with other SRB hydraulic components, are normally 
disassembled, inspected, and refurbished after each flight. This particular reservoir 
experienced extensive testing at USBI Florida Operations and Arkwin, the vendor, 
since STS-28. Arkwin indicated that they do not stock this nut. Bracket 
components, including the nut, are supplied in kits, and a review at USBI Florida 
Operations found no nuts missing from kits. 

USBI performed a flow analysis of the hydraulic system. This analysis found 
insufficient flow through the reservoir to carry debris, such as the 1/4" nut, from the 
reservoir to the pump. 
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RESOLVED STS-37 SAFETY RISK FACTORS 


ELEMENT/ 
SEQ. NO. 


SRB 


2 (Continued) 


RISK COMMENTS/RISK ACCEPTANCE 

FACTOR RATIONALE 


TVC hydraulic reservoir found with Rationale for STS-37 flight was: 

1/4" nut wedged between piston and 

cylinder head. • The nut probably got into the reservoir during postflight disassembly. 

• Reservoir installation performed per OMI reduced the potential for 
introduction of foreign material by requiring proximity component 
installation to be complete prior to reservoir plug removal. 

• Flow analysis indicated insufficient flow to propel the nut from the 
reservoir to the hydraulic pump. 

This risk factor was resolved for STS-37. 
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RESOLVED STS-37 SAFETY RISK FACTORS 


ELEMENT/ 
SEQ. NO. 


SRM 

1 


RISK COMMENTS/RISK ACCEPTANCE 

FACTOR RATIONALE 


Test and Evaluation Motor (TEM)-7 
fixed housing ablative liner debond. 

HR No. BN-08 Rev. C {C} 

No similar Solid Rocket Motor (SRM) 
anomalies were reported on STS-37. 


Post-test examination of the TEM-7 nozzle revealed 100% debond of the fixed 
housing ablative liner from the metal housing. Erosion of the 4 ground-test 
pressure transducer metal fittings was also witnessed. Investigation revealed that 
the debond was related to the ground-test configuration (pressure transducer 
fittings); these fittings are not used on inflight nozzles. Oval-shaped sooted flow 
areas were found around all 4 pressure transducer ports. There was no evidence, 
however, of hot-gas flow entering the liner/metal housing interface at the ends of 
the phenolic liner. There was no flight history of fixed housing ablative liner-to- 
metal housing debonds. 

Rationale for STS-37 flight was: 

• The debonds experienced were unique to the test configuration. 

• Flight and static test history revealed no evidence of the TEM-7 type 
debond. 

This risk factor was resolved for STS-37. 


Inner Boot Ring (IBR) bond line 
separation on STS-38 RH SRM. 

HR No. BN-08 Rev. C. {C} 

No similar SRM anomalies were 
experienced on STS-37. 


The IBR fixed-housing bond line on the STS-38 RH SRM was found to be 
approximately 80% separated during a special investigation conducted at postflight 
disassembly. There were splashdown-related impact marks made by snubber 
retainer bolts on the bearing end ring in the 270° region. This is indicative of high 
water-impact loads. 

The IBR and fixed-housing insulation remained in position; no displacement or 
edge separations were observed. Removal of IBR and fixed-housing insulation by 
machining revealed the IBR bond line separation. The IBR remained bonded to 
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RESOLVED STS-37 SAFETY RISK FACTORS 


ELEMENT/ 
SEQ. NO. 


SRM 

2 (Continued) 


RISK COMMENTS/RISK ACCEPTANCE 

FACTOR RATIONALE 


the metal housing in the 90° region. The IBR remained bonded to the fixed- 
housing insulation, and the fixed-housing insulation was well bonded to the metal 
housing. No soot or combustion products were found in the separated bond line; it 
remained intact and/or the ends sealed throughout motor operation. The physical 
evidence was consistent with splashdown-induced damage; however, there was no 
previous documentation of this type of separation. 

Detailed investigation of STS-35 IBRs found bond lines completely intact. 

Structural analysis predicted that the IBR fixed-housing bond line exceeded a 
2.0 FOS during motor operation. The analysis indicated post-bum separation was 
possible due to the splashdown environment; the potential existed for a 
contaminated and thermally-degraded bond line at the time of splashdown. There 
were also splashdown-induced tensile loads. 

Rationale for STS-37 flight was: 

• IBR failure was due to post-motor-burn events. Snubber damage indicated 
a high impact-loading event. High water-impact loads, in conjunction with 
elevated bond line temperatures and contamination, could cause bond line 
failure. 

• IBR processing was consistent with previous successfully-flown parts. 

• The flight FOS was >2.0 at the maximum potential contamination level 
(60 mg/ft 2 ). 

• Redesigned Solid Rocket Motor (RSRM) structural analysis indicated a 
potential FOS < 1.0 at water impact. 

This risk factor was resolved for STS-37. 


IBR bond line separation on STS-38 RH 
SRM. 
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RESOLVED STS-37 SAFETY RISK FACTORS 


ELEMENT/ 
SEQ. NO. 


SRM 

3 


RISK COMMENTS/RISK ACCEPTANCE 

FACTOR RATIONALE 


RTV was found past the primary O-ring 
of nozzle joint #5 on disassembly of 


TEM-7. 


HR No. BN-03 Rev. C {AR} 

No similar SRM anomalies were reported 
on STS-37. 


Upon disassembly of TEM-7, RTV was found past the primary O-ring of nozzle 
joint #5 (fixed housing-to-aft end ring). The concern was that the RTV could 
prevent proper sealing of the joint #5 O-ring, allowing a gas path. This was the 
fust time that this condition was seen on joint #S of a High Performance Motor 
(HPM); similar conditions were seen at joints #3 and #4 on previous HPM nozzle 
configurations. There were no similar occurrences on flight motors. While the 
HPM configuration only has the primary O-ring, flight motors have a secondary 
O-ring and bolt Stat-O-Seals. Leak tests verify the integrity of the secondary seals 
after assembly of a flight motor. 

RTV typically extends partially down the axial section of the joint, and sometimes 
reaches the primary O-ring. The O-ring forces uncured RTV away from the seal 
footprint, maintaining the sealing interface. Tests have demonstrated that the RTV 
and the fluorocarbon O-ring are compatible, with no adverse effects on O-ring 
sealing properties. 

Under normal flight operating conditions, nozzle joint #5 primary and secondary 
seal gaps close or remain stationary. The thermal environment witnessed at 
joint #5 is reduced by its location behind the flex boot. Thermal analysis predicted 
no heat effects on O-ring sealing if there were blowpaths to the primary O-ring. 
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ELEMENT/ 
SEQ. NO. 


SRM 

3 (Continued) 


RISK COMMENTS/RiSK ACCEPTANCE 

FACTOR RATIONALE 


RTV was found past the primary O-ring Rationale for STS-37 flight was: 

of nozzle joint #5 on disassembly of 

TEM-7. • There was no history of similar conditions on flight motors. 

• The flight motor configuration provides a secondary O-ring and 
Stat-O-Seals for further protection. 

• Leak tests verify the secondary seal integrity. 

This risk factor was resolved for STS-37. 
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SECTION 5 


STS-35 INFLIGHT ANOMALIES 


This section contains a list of Infli ght Anomalies (IF As) arising from the 
STS-35/OV-102 mission, the previous Space Shuttle flight. Each anomaly is briefly 
described, and risk acceptance information and rationale are provided. 

Hazard Report (HR) numbers associated with each risk factor in this section are 
listed beneath the anomaly title. Where there is no baselined HR associated with the 
anomaly, or if the associated HR has been e limin ated, none is listed. Hazard closure 
classification, either Accepted Risk {AR} or Controlled {C}, is included for each HR 
listed. 
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SECTION 5 INDEX 


STS-3S INFLIGHT ANOMALIES 


ELEMENT/ 

SEQ. NO. ANOMALY PAGE 


INTEGRATION 

1 Backup Flight System software patch for pad B definition of 5-3 

longitudinal location was incorrect. 

ORBITER 


1 Left Reaction Control System drain panel heater "A" was not at 5-5 

normal temperature. 

2 Degradation of waste water dump function. 5-6 

3 -Z star tracker Serial Number 006 failed two initial self-tests. 5-8 

4 Payload Bay Door environmental seal debond. 5-9 

5 Water Spray Boiler #3A operation was abnormal during ascent and 5-10 

entry. 

6 Window W-l has a 0.15" diameter chip. 5-11 

7 Water Spray Boiler #2 was subjected to abnormally large quantities 5-11 

of wax. 

8 Reaction Control System vernier thruster R5D failed "off'. 5-12 

9 Orbiter/Extemal Tank Liquid Oxygen aft attach/separation hole 5-13 

plugger did not fully extend. 

10 Right-hand stop bolt was found bent on the STS-35 centering ring of 5-14 

the forward External Tank attach/separation assembly. 

11 Pilot seat down-limit switch failure. 5-16 

SRM 

1 Heat-affected Carbon Cloth Phenolic seen on the left Solid Rocket 5-17 

Motor at nozzle joint #3. 


ET 

1 External Tank Thermal Protection System divots found at the 5-19 

intertank-to-hydrogen flange. 
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STS-35 INFLIGHT ANOMALIES 


ELEMENT/ 
SEQ. NO. 


INTEGRATION 

1 


COMMENTS/RISK ACCEPTANCE 
ANOMALY RATIONALE 


Backup Flight System (BFS) software 
patch for pad B definition of longitudinal 
location was incorrect. 

IFA No. STS-35-I-01 

HR No. ORBI-066 {AR} 

There were no 1-load patches required to 
support STS-37; therefore, no similar BFS 
anomaly was experienced. 


Relocation of STS-35 from pad A to pad B required an I-load software patch to 
include the pad B location definition. During ascent, a difference of 143 feet (ft) 
was witnessed between the position data sent from the BFS and the Primary 
Avionics Software System (PASS). 

Post-ascent evaluation of telemetry data identified an error in the sixth BFS 
software patch for pad B. An error was found in the sixth digit of the longitude 
string. Investigation determined that the error was caused by software developers at 
Rockwell International (RI)/Downey who incorrectly read the Change 
Request (CR). CR 90365 was faxed to RI/Downey and was used as the authority 
for the I-load software patch. All who read CR 90365 interpreted the longitude 
position as -1.40709036E+00; the correct value was -1.40709836E+00. Verification 
of this value was not made at RI/Downey prior to incorporation into the I-load. 
Verification could have been made through comparison with the electronic data set 
associated with CR 90365. 

The modified BFS I-load passed STS-35 certification testing. Pass/fail criteria for 
downrange position at Mam Engine Cutoff (MECO) command is ±600 ft; a value of 
322 ft was observed and accepted during testing. The worst-case effect for 
downrange position at MECO command if the position is greater than ±600 ft is 
that either the External Tank (ET) would land outside the predicted footprint or 
there would be insufficient propellant to continue the mission. 
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STS-35 INFLIGHT ANOMALIES 


ELEMENT/ 
SEQ. NO. 


INTEGRATION 
1 (Continued) 


COMMENTS/RISK ACCEPTANCE 
ANOMALY RATIONALE 


BFS software patch for Pad B definition To ensure that conditions will not exist for future occurrence of a similar type of 

of longitudinal location was incorrect. error, all CRs that require I-load patches must be accompanied by the associated 

electronic data set for verification. 

Rationale for STS-37 flight was: 

• There were no I-load patches required to support STS-37. 

• Procedures were in place to verify I-load data if a patch was required prior 
to launch. 

• Large errors are detectable during I-load software certification testing. 

This anomaly was resolved for STS-37. 
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STS-35 INFLIGHT ANOMALIES 


ELEMENT/ COMMENTS/RISK ACCEPTANCE 

SEQ. NO. ANOMALY RATIONALE 


ORBITER 

1 


Left Reaction Control System (RCS) 
drain panel heater "A" was not at normal 
temperature. 

IFA No. STS-35-04 

No anomalous RCS healer operation was 
reported on STS-37. 


On orbit, the left RCS drain temperature indicated that the heater did not cycle at 
the expected 56.6 “F. The temperature on heater "A" went down to 52 °F before the 
crew was instructed to switch to heater "B". The "B" heaters operated nominally 
after switchover. 

Data analysis determined that the "A" heater cycled once normally prior to this 
failure. On-orbit troubleshooting included switching back to heater "A* and 
allowing the left RCS drain temperature to drop to 40 °F, which confirmed the 
failure of heater A" to cycle properly. Because of the attitude of the vehicle, the 
RCS drain temperature did not go below 40 °F for the remainder of the mission. 
The Shuttle Operational Data Book (SODB) limit is +20°F; RCS oxidizer freezes 
at +12 # F, and the fuel freezes at -60 “F. 

This was believed to be an isolated failure, with no indication of a generic problem. 
The most likely cause of this anomaly was a failed thermostat. There were no 
reported problems with the left RCS drain panel thermostat on previous OV-102 
missions. RCS heaters are Criticality (Crit) 2R3 components. RI is currently 
investigating if there are any Crit 1 applications of this thermostat. 

Rationale for STS-37 flight was: 

• RCS drain heaters were redundant. 

• Loss of both heaters required a preferred attitude maneuver for 
temperature control [Flight Rule (FR) 6-10BJ. 
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STS-35 INFLIGHT ANOMALIES 


ELEMENT/ 
SEQ. NO. 


ORBITER 
1 (Continued) 

2 


COMMENTS/RISK ACCEPTANCE 
ANOMALY RATIONALE 


Left RCS drain panel heater ”A" was not • If temperature control cannot be maintained with attitude maneuvering, the 

at normal temperature. worst-case effect would be mission termination (FR 6-10B). 

Not a safety concern for STS-37. 


Degradation of waste water dump Water from the waste water storage tank is periodically dumped overboard into 

function. space during a nominal mission. A gradual degradation of the waste water dump 

rate was noted during the first 3 dump cycles. The line was completely blocked on 
IFA No. STS-35-05 the fourth dump. Inflight maintenance was performed with no success. Waste tank 

offload into the Contingency Water Container (CWC) and urine collection devices 
HR No. ORBI-254 {AR} was required for the remainder of the mission. A decision was made to manifest 

additional CWCs on all subsequent flights. 

No waste water dump problems were 

experienced on STS-37. Similar problems on STS-32/OV-102 led to removal and cleaning of the last 22" of 

the dump line. It is believed that the blockage on STS-3S was upstream of this 
section. 

Troubleshooting of this STS-35 anomaly found that the waste water dump line filter 
had deteriorated and was the root cause of the line blockage. The filter assembly 
has 3 filters (coarse, medium, and fine) and is replaced after 3 flights. It was 
determined that the polyurethane filter material deteriorates after approximately 
8 years. A spare filter assembly obtained from the logistics stockroom showed 
similar signs of deterioration. This spare filter, manufactured in 1980, had never 
been used (still in the shipping package). 
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STS-35 INFLIGHT ANOMALIES 


ELEMENT/ 
SEQ. NO. 


QRBITER 
2 (Continued) 


COMMENTS/RISK ACCEPTANCE 
ANOMALY RATIONALE 


Degradation of waste water dump These findings led to a check of the STS-39/OV-103 waste water dump line filter 

function. assembly. Upon removal, it was also found to be deteriorated. The 3"-long 

#3 filter (coarse) had approximately two-thirds of the material missing. When the 
#2 filter (medium) was touched, it fell apart. The #1 filter (fine) was completely 
gone, and a small amount of gray powder residue was found in the liquid remaining 
in the filter assembly housing. The STS-39/OV-103 replacement filter was 
manufactured in 1988. The STS-37/OV-104 waste water dump line filter assembly 
was also inspected; it showed no degradation of any filter elements. These filter 
elements were from the lot manufactured in 1988. The STS-37/OV-104 waste 
water dump line was flushed and tested. 

Rationale for STS-37 flight was: 

• The waste water dump line filter was believed to be the cause of the 
STS-35/OV-102 line blockage; STS-37/OV-104 filters were verified to be 
good. 

• The capacity of the waste storage tank was adequate for a minimum- 
duration mission without water dump. 

• Three or more failures were required to cause crew illness. A second 
CWC was added to the STS-37 manifest. 

Not a safety concern for STS-37. 
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STS-35 INFLIGHT ANOMALIES 


ELEMENT/ 
SEQ. NO. 


ORBITER 

3 


COMMENTS/RISK ACCEPTANCE 
ANOMALY RATIONALE 


-Z star tracker Serial Number (S/N) 006 
failed 2 initial self-tests. 

IFA No. STS-35-10 

No star tracker anomalies were reported on 
STS-37. 


On the initial power-up, -Z star tracker S/N 006 failed the first 2 self-tests. 

Position errors were observed on the first self-test software cycle. All subsequent 
software cycles indicated the correct Built-In Test Equipment (BITE) star position. 
The -Z star tracker passed the third self-test and 5 additional self-test cycles. 
Performance thereafter was nominal. 

Initial evaluation determined that the star tracker electronics may not have 
responded quickly enough to start acquisition during the first 2 self-test cycles. It 
was believed that this slow response time could be a function of warmup time. 
Minimum warmup time is 15 minutes (min); however, the STS-35/OV-102 star 
trackers had power on for 25 min prior to the first 2 self-test cycles. This slow 
response condition was seen during laboratory tests on other units; however, this 
was the first occurrence in flight. 

This anomaly is a Crit 1R3 failure mode. The -Y star tracker and the Crew Optical 
Alignment Sight (COAS) have redundant functions to the -Z star tracker. 

Rationale for STS-37 flight was: 

• There are 3 redundant strings: -Z star tracker, -Y star tracker, and COAS. 
Not a safety concern for STS-37. 
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STS-35 INFLIGHT ANOMALIES 


ELEMENT/ 

SEQ. NO. ANOMALY 


COMMENTS/RISK ACCEPTANCE 
RATIONALE 


ORBITER 

4 


Payload Bay Door (PLBD) environmental 
seal debond. 

IFA No. STS-35-16 

No problems were experienced with PLBD 
environmental seals on STS-37. 


Postflight inspection of OV-102 found a 24" piece of the environmental seal loose 
between panels #1 and #2 at the top of the right PLBD. The loose seal material 
was cut off prior to the ferry flight to preclude further loosening or damage. There 
was no apparent damage internal to the payload bay. This was a first-time 
occurrence in this area. A 6" splice segment of the PLBD-to-aft bulkhead 
environmental seal debonded on STS-41/OV-103. Evaluation of the STS-41 
problem determined the cause to be improper application of the seal (bad etching 
and bonding). Investigation into the cause of the STS-35 anomaly continues. 

STS-37/OV-104 PLBD environmental seals were visually inspected because of the 
problem experienced on STS-41. This inspection found no problems. The visual 
inspection was only sufficient to indicate whether the seal was protruding from the 
"monkey fur". 

Rationale for STS-37 flight was: 

• Visual inspection found no problems. 

This anomaly was resolved for STS-37. 
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STS-35 INFLIGHT ANOMALIES 


ELEMENT/ 
SEQ. NO. 


ORBITER 

5 


COMMENTS/RISK ACCEPTANCE 
ANOMALY RATIONALE 


Water Spray Boiler (WSB) #3A 
operation was abnormal during ascent 
and entry. 

IFA No. STS-35- 17 

HR No. ORBI-036 {AR} 

ORBI-121 {AR} 

Similar problems were encountered with 
WSB operation on STS-37 (IFA No. 
STS-37-V-02A ). WSB #2 did not cool 
APU lube oil while under operation of 
controller ’ A " and operation had to be 
switched to controller " B " when lube oil 
temperature reached 280" F. The most 
probable cause of the problem was again 
believed to be freezing of the spray bar 
caused by wax buildup in the WSB. ( See 
Section 7, Orbiter 2 for more details.) 


During ascent, WSB #3A did not initiate spray cooling until Auxiliary Power Unit 
(APU) #3 lube oil return temperature reached 277 °F. WSB cooling operations 
should begin at 250 *F. During reentry operations, WSB #3A overcooled the lube 
oil. A similar anomaly occurred with WSB #2A on STS-38/OV-104 (see Section 6, 
Orbiter 1 for more details). 

Preliminary analysis indicated that the presence of wax in the APU #3 lube oil may 
have caused the spray bar to freeze. The lube oil temperature increased until the 
spray bar thawed and proper cooling commenced. 

A hot-oil flush will be performed during the STS-40/OV-102 turnaround process. 
WSB #3A operations will be tested after the hot-oil flush. 

Rationale for STS-37 flight was: 

• WSB #2A controller was replaced on STS-37/OV-104. 

• Operational Maintenance Requirements and Specifications Document 
(OMRSD) testing on STS-37/OV-104 indicated proper WSB functioning. 

• Redundant systems were available. 

Not a safety concern for STS-37. 
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STS-35 INFLIGHT ANOMALIES 


ELEMENT/ 
SEQ. NO. 


ORBITER 

6 


COMMENTS/RISK ACCEPTANCE 
ANOMALY RATIONALE 


Window W-l has a 0.15" diameter chip. 

IFA No. STS-35-18 

HR No. ORBI-009 {AR} 

No window anomalies were reported on 
STS-37. 


Postflight inspection of the OV-102 windows revealed a chip in window W-l, 
measuring 0.15" in diameter and 0.0109" in depth. A "spider web" type crack 
formation was found radiating from the impact point. During the crew debriefing, 
it was determined that the crew first noted the chip on Flight Day (FD) 6. It is 
believed that the chip occurred during ascent. Window W-l will be removed and 
replaced prior to the next OV-102 mission. Further examination of the window will 
be performed to attempt to determine the cause of the chip. 

This risk factor was acceptable for STS-37. 


WSB #2 was subjected to abnormally 
large quantities of wax. 

IFA No. STS-35- 19 

HR No. ORBI-121 {AR} 

(See Orbiter 5 in this section.) 


During ascent and entry, indication of a large amount of wax was noted in the 
APU #2 lube oil system. This condition subjected WSB #2 to wax in the lube oil; 
therefore, WSB #2 will require a hot-oil flush during STS-40/OV-102 turnaround 
processing. APU #2 will be removed and replaced during this process to comply 
with life-limit criteria. 

Not a safety concern for STS-37. 
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STS-35 INFLIGHT ANOMALIES 


ELEMENT/ 
SEQ. NO. 


ORBITER 

8 


COMMENTS/RISK ACCEPTANCE 
ANOMALY RATIONALE 


RCS vernier thruster R5D failed "off 1 . 

IFA No. STS-35-20 

HR No. ORBI-056 {C} 

RCS primary thruster R1U failed " off” 
during the ET separation maneuver on 
STS-37 (IFA No. STS-37-V-01). However, 
in this case the problem was believed to be 
caused by iron nitrate contamination of the 
oxidizer valve poppet; pressure traces from 
the R1U failure were similar to those seen 
on SIS -36 thruster failures that were 
attributed to this type of contamination. 
(See Section 7, Orbiter 2 for more details.) 

There were indications of low Chamber 
Pressure (PJ on STS-37/OV-104 primary 
thrusters LIU and L1L during firing in the 
interconnect configuration (IFA No. 
STS-37-V-08). P c in these thrusters 
returned to nominal after reconfiguration to 
straight feed. Contamination in the 
oxidizer interconnect line was suspected. 
(See Section 7, Orbiter 4 for more details.) 


During orbital maneuvering, RCS vernier thruster R5D exhibited low P c and was 
deselected by Redundancy Management (RM). Data evaluation indicated that 
helium was present in the crossfeed line. A similar failure was seen on STS-9. 
Vernier thruster R5D was successfully hot-fired on orbit to flush out the helium. 
Evaluation of the hot-fire data indicated some gas ingestion during the first pulse 
and none in the 4 subsequent pulses. RM was reset following nominal performance 
during the hot-fire. 

Rationale for STS-37 flight was: 

• There were redundant down-firing thrusters in each Orbital Maneuvering 
System (OMS) pod. 

• Small helium bubbles trapped in propellant lines can be removed by hot- 
firing the thrusters. 

• A vernier thruster deselected because of helium bubbles can be reselected 
after gas is flushed out of the system during a hot-fire. 

This risk factor was acceptable for STS-37. 


5-12 


STS-37 Postflight Edition 





STS-35 INFLIGHT ANOMALIES 


ELEMENT/ 
SEQ. NO. 


ORBITER 

9 


COMMENTS/RISK ACCEPTANCE 
ANOMALY RATIONALE 


Orbiter/ET Liquid Oxygen (L0 2 ) aft 
attach/separation hole plugger did not 
fully extend. 

IFA No. STS-35-21 

HR No. ORBI-302A {AR} 

No problems with this hole plugger were 
reported on STS-37. 

Rationale for STS-37 flight was: 

• The likelihood of debris jamming the ET umbilical door is remote. 

• Doors may be recycled in flight if closing or latching is obstructed. 

• The ET separation burn moves the Orbiter away from any escaping debris. 
This risk factor was acceptable for STS-37. 


The Orbiter/ET L0 2 aft attach/separation hole plugger did not complete its stroke. 
One of the 2 pyros was jammed between the plugger and the rim of the hole. The 
other pyro device was not found and may have escaped. No debris was found on 
the runway after the ET doors were opened. Similar hole plugger failures occurred 
on STS-29 and STS-34. 

The concern was that loose debris could block the ET umbilical door from fully 
closing, resulting in the potential loss of the crew and vehicle during reentry. The 
likelihood of escaping fragments preventing the ET umbilical door from closing was 
determined to be remote. The ET doors may be recycled in flight if closing or 
latching is obstructed. The Orbiter performs a maneuver at ET separation, moving 
away from the ET and escaping possible debris prior to ET umbilical door closure. 
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STS-35 INFLIGHT ANOMALIES 


ELEMENT/ 

SEQ. NO. ANOMALY 


COMMENTS/RISK ACCEPTANCE 
RATIONALE 


ORBITER 

10 


Right-Hand (RH) stop bolt was found 
bent on the STS-35 centering ring of the 
forward ET attach/separation assembly. 

IFA No. STS-35-22 

HR No. INTG-051B {C} 


No problems with these stop bolts were 
reported on STS-37. 


Postflight inspection of STS-35/OV-102 found the RH stop bolt bent approximately 
5 0 from center. Bending of stop bolts was previously experienced on STS-34, 
STS-32, and STS-38 (not reported as an IFA on STS-38/OV-104). Damage to the 
STS-35/OV-102 stop bolt was worse than that seen on STS-38, but not as bad as 
the STS-34 anomaly. The left and right stop bolts restrict side rotation of the 
centering ring during Orbiter/ET mate. They are not designed to carry any mate 
or flight loads. 

Review of ground operations determined that mating and demating operations have 
the physical capability to bend the stop bolts. Mating procedures were modified 
after STS-34 to control the yoke position and preclude the potential for bolt damage 
during mating operations. No stop bolts were reported bent during the next several 
missions; however, there were no modified requirements for demating operations on 
these flights. Because of the reports of bent stop bolts on STS-38 and STS-35, 
where both flows required Orbiter demate from the ET, a modified demate 
procedure was developed and submitted for approval. New mate/demate Ground 
Support Equipment (GSE) with improved visual and digital readout will be 
available in mid-1991. Additionally, a more robust stop bolt design is in evaluation 
for future use. 

No anomalies were recorded during the STS-35 ET/Orbiter mating process. 
Misalignment of the ET attach points, EO-2 and EO-3, was not considered a 
contributor to this anomaly. A bent stop bolt is a Crit 3 failure. Analysis 
conducted during the investigation of previous instances of bent or damaged stop 
bolts determined that a moment of 430-2100 inch-pounds (in-lb) could locally 
deform the bolt end. This moment could be generated by either side-to-side 
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STS-35 INFLIGHT ANOMALIES 


ELEMENT/ 
SEQ. NO. 


ORBITER 
10 (Continued) 


COMMENTS/RISK ACCEPTANCE 
ANOMALY RATIONALE 


RH stop bolt was found bent on the 
STS-35 centering ring of the forward ET 
attach/separation assembly. 


Rationale for STS-37 flight was: 

• The bent stop bolt on STS-38/OV-104 was repaired during the 
STS-37/OV-104 processing flow. 

• All stop bolts, even when bent, have performed the intended function. 

• Stop bolts do not carry flight loads and are nonfunctional after Orbiter/ET 
mate. 

• Analysis demonstrated that there were no known flight loads that could 
cause stop bolt bending. 

This anomaly was resolved for STS-37. 


movement during normal handling or by the small, pyro-initiated rocking motion at 
separation. The rocking motion was first seen during review of pyro qualification 
test film. The bolts used in the qualification tests also exhibited local flat spots 
similar to those seen on the STS-32 stop bolts. The rocking motion, however, was 
determined to be insufficient to cause the bolt bending experienced on STS-34. 
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STS-35 INFLIGHT ANOMALIES 


ELEMENT/ 
SEQ. NO. 


ORBITER 

11 


COMMENTS/RISK ACCEPTANCE 
ANOMALY RATIONALE 


Pilot seat down-limit switch failure. During ingress and prelaunch operations, the pilot attempted to make seat 

adjustments. The pilot seat failed to drive down. This is a repeat of an STS-32 
IFA No. STS-35-23 anomaly (IFA No. STS-32-27). The seat operated properly on orbit. 

HR No. ORBI-340 {AR} The down-limit switch was replaced during the STS-35 turnaround process. Further 

troubleshootbg will be performed at KSC. This anomaly is unique to OV-102. 

No problems with the pilot seat were 

reported on STS-37. Rationale for STS-37 flight was: 

• There were no problems experienced with crew seats on STS-38/OV-104. 
The only operational problem history has been on OV-102. 

Not a safety concern for STS-37. 
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STS-35 INFLIGHT ANOMALIES 


ELEMENT/ COMMENTS/RISK ACCEPTANCE 

SEQ. NO. ANOMALY RATIONALE 


SRM 

1 


Heat-affected Carbon Cloth Phenolic 
(CCP) seen on the left Solid Rocket 
Motor (SRM) at nozzle joint #3. 

IFA No. STS-35-M-01 

HR No. BN-03 Rev. C {AR} 

No heat effect problems associated with the 
SRM CCP were reported on STS-37. 


During postflight inspection of left SRM nozzle joint #3 by Thiokol 
Corporation (TC), a 1.5" gas path was observed through a Room-Temperature 
Vulcanizing (RTV) void at 195° of the CCP. Surface heat effects and associated 
sooting resulted. Heat effects on the virgin CCP were seen approximately 
1.0" radially past the char line and appeared to be on the surface only. Soot 
reached the primary O-ring, approximately 12" circumferentially in both directions 
from the 195* position. There were no blowby erosion or heat effects to the 
primary O-ring. Metal nozzle components were not affected. 

The RTV contributes as a thermal barrier only and is not considered a seal in the 
nozzle joints. RTV below the char line is a design goal only and is not a 
performance requirement. To date, all RTV backfill nozzle joints have met design 
requirements. No flight or static test motor nozzle joints have exhibited primary 
O-ring heat effects, erosion, or blowby. 

This was the first occurrence of heat-affected CCP in nozzle joint #3. Heat- 
affected CCP, silica cloth phenolic, and glass cloth phenolic were seen in joint #2 
(nose inlet bearing/cowl) of STS-36, QM-7, and PVM-1, all with no O-ring heat 
effects. Gas paths and soot in nozzle joints were within the experience base of 26 
flight SRMs and 7 static test nozzles. TC plans to conduct an aero/thermal analysis 
of nozzle joint #3 to determine the gas volume and flow characteristics associated 
with this STS-35 anomaly. 
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STS-35 INFLIGHT ANOMALIES 


ELEMENT/ 
SEQ. NO. 


SRM 

1 (Continued) 


COMMENTS/RISK ACCEPTANCE 
ANOMALY RATIONALE 


Heat-affected CCP seen on the left SRM Rationale for STS-37 flight was: 

at nozzle joint #3. 

• There was no history of blowby, erosion, or heat effects on the primary 
O-ring experienced with gas paths through SRM nozzle RTV voids. 

• The gas path and soot witnessed on STS-35 nozzle joint #3 was within the 
experience base of 26 flight SRMs and 7 test motors. 

This risk factor was acceptable for STS-37. 
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STS-35 INFLIGHT ANOMALIES 


ELEMENT/ 

SEQ. NO. ANOMALY 


COMMENTS/RISK ACCEPTANCE 
RATIONALE 


ET 

1 


ET Thermal Protection System (TPS) 
divots found at the intertank-to-hydrogen 
flange. 

IFA No. STS-35-T-01 

HR No. INTG-008B {AR} 

INTG-037B {AR} 

INTG-081A {AR} 

No ET anomalies were reported on 
STS-37. 


During review of ET photographs taken by the STS-35 crew after separation, 

11 circular TPS divots were observed. All were located on the intertank-to- 
hydrogen flange. Six divots were on the left side of the tank; the other 5 were on 
the right side. The divots were estimated to be from T to 10" in diameter. 

The ET intertank flanges are closed out after the splice/mate of the L0 2 tank to 
the Liquid Hydrogen (LH 2 ) tank. The intertank flanges are then manually sprayed 
with BX-250 foam, which is bonded to existing tank foams by an isochem adhesive. 
Adhesive voids cannot be detected by visual inspection, and there is currently no 
available nondestructive test to verify proper adhesion. Martin Marietta 
Corporation (MMC) is reviewing STS-37/ET-37 build paper for potential 
anomalies; however, nothing of significance is expected to be found. 

Review of similar photographs from STS-28 found a large divot in the ET intertank 
acreage TPS. This divot was estimated at 23" x 15" and > 1" in depth. No 
conclusion was reached as to the cause of the STS-28 divot; however, when possible, 
all crews have been asked to photograph the ET after separation. The divots seen 
on STS-35 were the first experienced since STS-28. 

Review of the STS-35 ET photographs by MMC determined that the divots did not 
expose ET tank metal. The "whitish" color was believed to be fresh BX-250 foam 
that was not exposed to the weather. Worst-case analysis performed by MMC 
indicated that bare ET tank metal of the divot sizes seen on STS-35 would not 
result in structural or thermal problems. 
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STS-35 INFLIGHT ANOMALIES 


ELEMENT/ 
SEQ. NO. 


ET 

1 (Continued) 


COMMENTS/RISK ACCEPTANCE 
ANOMALY RATIONALE 


ET TPS divots found at the intertank-to- Rationale for STS-37/ET-37 flight was: 

hydrogen flange. 

• No anomalous conditions were reported during the manufacturing and 
testing of ET-37. 

• MMC worst-case analysis determined that no structural or thermal 
problems result from bare ET-tank metal of the divot sizes seen on STS-35. 

This risk factor was acceptable for STS-37. 
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SECTION 6 


STS-38 INFLIGHT ANOMALIES 


This section contains a list of Infli ght Anomalies (IF As) arising from the 
STS-38/OV-104 mission, the previous flight of the Orbiter vehicle. Each anomaly is 
briefly described, and risk acceptance information and rationale are provided. 

Hazard Report (HR) numbers associated with each anomaly in this section are 
listed beneath the anomaly title. Where there is no baselined HR associated with the 
anomaly, or if the associated HR has been eliminated, none is listed. Hazard closure 
classification, either Accepted Risk { AR } or Controlled {C}, is included for each HR 
listed. 
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SECTION 6 INDEX 


STS-38 INFLIGHT ANOMALIES 

ELEMENT/ 

SEQ. NO. ANOMALY PAGE 

ORBITER 

1 Water Spray Boiler #2 did not cool Auxiliary Power Unit lube oil 6-3 

while under operation of controller "A". 

2 Flash Evaporator System water supply accumulator heater system 6-4 

biased low. 

3 Auxiliary Power Unit #3 X-axis acceleration trace erratic. 6-4 

4 Vacuum cleaner short circuit. 6-5 

5 Auxiliary Power Unit Exhaust Gas Temperature instrumentation 6-6 

interaction with injector tube temperature instrumentation. 

6 Right vent doors #1 and #2 purge position failure. 6-7 

7 Continuous "tire press” Fault Detection and Annunciation message 6-8 

following landing gear safing. 

8 Transient smoke detector event indication anomaly. 6-9 
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STS-38 INFLIGHT ANOMALIES 


ELEMENT/ COMMENTS/RISK ACCEPTANCE 

SEQ. NO. ANOMALY RATIONALE 


ORBtTER 

1 


Water Spray Boiler (WSB) #2 did not 
cool Auxiliary Power Unit (APU) lube oil 
while under operation of controller "A". 

IFA No. STS-38-01 

HR No. ORBI-036 {AR} 

Similar problems were encountered with 
WSB operation on STS-37 (IFA No. 
STS-37-V-02A ). WSB #2 did not cool 
APU kibe oil while under operation of 
controller "A" and operation had to be 
switched to controller ”B" when lube oil 
temperature reached 280“ F. The most 
probable cause of the problem was again 
believed to be freezing of the spray bar 
caused by wax buildup in the WSB. (See 
Section 7, Orbiter 2 for more details.) 


WSB #2 controller "A" failed to cool APU lube oil after the end of the pool boiling 
period during ascent. The crew switched to controller "B" when the temperature 
reached 275T 7 , and APU #2 was left "on” after APUs #1 and #3 were shut down. 
After switching to controller "B”, lube oil temperature peaked at 300°F before 
cooling was observed after 66 seconds (sec). Controller "A" was selected for reentry 
to determine if the temperature control operated properly; controller "A" operated 
normally. It was believed that spray bar freeze-up on controller "A" during ascent 
caused the problem. Freezing of the spray bar could have been caused by low heat 
load on APU #2, or controller "A" was not functioning properly. A similar cooling 
problem was experienced on STS-1 through STS-4 and on STS-35/OV-102. 

Rationale for STS-37 flight was: 

• WSB #2 was replaced. 

• Operational Maintenance Requirements and Specifications Document 
(OMRSD) testing on STS-37/OV-104 indicated proper WSB controller 
operation. 

This anomaly was resolved for STS-37. 
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r-o 


STS-38 INFLIGHT ANOMALIES 


ELEMENT/ 
SEQ. NO. 


ORBITER 

2 


COMMENTS/RISK ACCEPTANCE 
ANOMALY RATIONALE 


Flash Evaporator System (FES) water 
supply accumulator heater system biased 
low. 

IFA No. STS-38-02 

HR No. ORBI-276B {C} 

No FES problems were reported on 
STS-37. 


FES heater #1 did not cycle "on” within its prescribed temperature range of 
55-75°F. When the temperature reached 49°F, heater string #2 was activated and 
cycled in the 48-54°F range with apparently normal duty cycles. Heater string #1 
was reactivated and cycled like heater string #2. A temperature sensor debond 
problem was the suspected cause of this anomaly. FES heater #1 was removed and 
replaced at Kennedy Space Center (KSC). 

Rationale for STS-37 flight was: 

• FES heater #1 was replaced and satisfactorily tested. 

This anomaly was resolved for STS-37. 


APU #3 X-axis acceleration trace erratic. During entry, APU #3 X-axis acceleration trace was erratic. The problem was 

believed to be a failed accelerometer. There was no previous accelerometer failure 
IFA No. STS-38-03B history. Troubleshooting at KSC included connector and accelerometer checkouts 

and isolated the anomaly to a broken coax in connector 50P3 pin A. APU #3 was 
No APU acceleration trace anomalies were removed and replaced to comply with life-time cycle limits. 

reported on STS-37. 

Rationale for STS-37 flight was: 

• The anomaly was isolated to broken coax. 

• APU #3 was removed and replaced during the STS-37/OV-104 flow. 

This anomaly was resolved for STS-37. 
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STS-38 INFLIGHT ANOMALIES 


ELEMENT/ 
SEQ. NO. 


ORBITER 

4 


COMMENTS/RISK ACCEPTANCE 
ANOMALY RATIONALE 


Vacuum cleaner short circuit. When the crew turned on the vacuum cleaner, Circuit Breaker (CB) #29 on panel 

L4 was activated by a current surge. Utility outlet M013Q was not used during the 
IFA No. STS-38-04A remainder of the flight; this outlet provides the electrical interface for the food 

heater and vacuum cleaner. Outlet testing was completed, and the outlet tested 
HR No. ORBI-301 {C} good. The vacuum cleaner was removed and sent to Johnson Space Center (JSC). 

Postflight troubleshooting verified a phase "B” short-to-case on the vacuum cleaner. 
No vacuum cleaner problems were reported Prelaunch vacuum cleaner checkout was modified to include a check for shorts on 

on STS-37. all 3 phases. The vacuum cleaner was replaced with a stock unit that passed the 

modified checkout procedure. 

Rationale for STS-37 flight was: 

• The anomalous vacuum cleaner was replaced. 

• New procedures verified the absence of shorts in the vacuum cleaner 
installed on STS-37/OV-104. 

This anomaly was resolved for STS-37. 
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STS-38 INFLIGHT ANOMALIES 


ELEMENT/ COMMENTS/RISK ACCEPTANCE 

SEQ. NO. ANOMALY RATIONALE 


ORBITER 

5 


APU Exhaust Gas Temperature (EGT) 
instrumentation interaction with injector 
tube temperature instrumentation. 

IFA No. STS-38-05 

HR No. ORBI-106A {AR} 

APU #2 injector tube temperature failed 
during STS-37 entry. The sensor unit went 
erratic and then failed low (IFA No. 
STS-37-V-10B). 


APU #2 EGT #1 and #2, and APU #2 and #3 injector tube temperatures, 
became erratic during launch. The APU injector tube temperatures became erratic 
concurrent with EGT sensor failures. The EGT failures affected the common 
Designated Signal Conditioner (DSC) power supply isolation card. The injector 
temperature instrumentation and EGTs utilize a common DSC. Analysis indicated 
that a momentary EGT short-to-ground may have provided a ground loop between 
the injector temperature and common power supply, resulting in erratic injector 
temperatures. There was no problem with injector tube temperature 
measurements; only the EGT measurements were affected. No action was taken by 
the crew. Injector temperature measurements remained functional. 

Rationale for STS-37 flight was: 

• The problem was isolated to an EGT short-to-ground, and repairs were 
made. 

This anomaly was resolved for STS-37. 
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STS-38 INFLIGHT ANOMALIES 


ELEMENT/ 
SEQ. NO. 


ORBITER 

6 


COMMENTS/RISK ACCEPTANCE 
ANOMALY RATIONALE 


Right vent doors #1 and #2 purge 
position failure. 

IFA No. STS-38-06 

HR No. ORBI-178A {AR} 

Vent door purge positioning operated 
normally on STS-37. 

Rationale for STS-37 flight was: 

• The anomalous PDU was replaced and tested satisfactory. 
This anomaly was resolved for STS-37. 


During postlanding vent door purge positioning operations, right vent doors #1 and 
#2 drove to the "closed" position instead of the "purge" position. Right vents #1 
and #2 are used to purge the forward Reaction Control System (RCS). STS-38 
purge could not be performed via right vents #1 and #2. This failure may have 
been a limit switch/contact problem. There are 2 limit switches for door "open" 
position, 2 for door "close” position, and 2 for "purge" position. Limit switch failure 
is Crit 1R4. The worst-case failure for the vent doors is Crit 1R2. Troubleshooting 
isolated the failure to the Power Distribution Unit (PDU). The PDU was replaced, 
and testing indicated satisfactory performance. 
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STS-38 INFLIGHT ANOMALIES 


ELEMENT/ COMMENTS/RISK ACCEPTANCE 

SEQ. NO. ANOMALY RATIONALE 


ORBITER 

7 


Continuous "tire press" Fault Detection 
and Annunciation (FDA) message 
following landing gear safing. 

IFA No. STS-38-08 

HR No. ORBI-018 {AR} 

No anomalous FDA tire pressure messages 
were experienced on STS-37. 


Continuous "tire press" messages were observed following landing gear safing 
procedures. During this procedure, one set of messages is expected after removal 
of the landing gear "arm" flag; however, continuous messages were noted. Initial 
visual inspection of the Tire Pressure Monitoring System (TPMS) showed no 
abnormalities. Troubleshooting found no other problems. This anomaly was closed 
as unexplained. 

Rationale for STS-37 flight was: 

• This was a first-time occurrence; there were no indications of a generic 
problem. 

This anomaly was resolved for STS-37. 
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STS-38 INFLIGHT ANOMALIES 


ELEMENT/ 
SEQ. NO. 


QRBITER 

8 


COMMENTS/RISK ACCEPTANCE 
ANOMALY RATIONALE 


Transient smoke detector event indication 
anomaly. 

IFA No. STS-38-09 

HR No. ORBI-300 {C} 

No problems were experienced with the 
avionics bay smoke detectors on STS-37. 


Smoke detector "3A“ in avionics bay "3A" did not have enough voltage to ring the 
alarm, but the event indicators (lights) lit. There were several previous instances of 
smoke detector failures where no apparent cause could be found. This occurrence 
was similar to the problem experienced on STS-41. 

On STS-32, avionics bay "3A" smoke detector "3A" experienced repeated transient 
alarms and associated lights. A decision was made to pull the sensor circuit breaker 
to avoid nuisance alarms during sleep, reentry, and landing periods. The sensor was 
removed and replaced. The defective unit was sent to the vendor for failure 
analysis, but the unit was damaged before the vendor could examine it. 

STS-38 smoke detector "3A" was removed, and failure analysis will be performed in 
conjunction with failure analysis of the STS-32 smoke detector anomaly. 

Rationale for STS-37 flight was: 

• Occurrences of this anomaly to date indicated a problem with the detector. 

• In no case was smoke found in the avionics bay. 

This anomaly was resolved for STS-37. 
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SECTION 7 


STS-37 INFLIGHT ANOMALIES 


This section contains a list of Inflight Anomalies (IF As) arising from the 
STS-37/OV-104 mission. Each anomaly is briefly described, and risk acceptance 
information and rationale are provided. 

Hazard Report (HR) numbers associated with each risk factor in this section are 
listed beneath the anomaly title. Where there is no baselined HR associated with the 
anomaly, or if the associated HR has been eliminated, none is listed. Hazard closure 
classification, either Accepted Risk {AR} or Controlled {C}, is included for each HR 
listed. 
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SECTION 7 INDEX 


STS-37 INFLIGHT ANOMALIES 


ELEMENT/ 

SEQ. NO. ANOMALY 


ORBITER 

1 Reaction Control System primary thruster R1U failed off during 
External Tank separation maneuver. 

2 Water Spray Boiler #2 did not cool Auxiliary Power Unit lube oil 
while under operation of controller "A". 

3 Power Reactant Supply and Distribution Oxygen manifold valve #2 
failed to close when commanded. 

4 Indications of low Chamber Pressure on primary thrusters LIU and 
L1L during interconnect operations. 

5 Backup Flight System navigation initialization anomaly. 

6 Water Spray Boiler #3 overcool dining entry. 

SRB 


1 Left-hand forward skirt skin panel buckling. 
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STS-37 INFLIGHT ANOMALIES 


ELEMENT/ 

SEQ. NO. ANOMALY 


COMMENTS/RISK ACCEPTANCE 
RATIONALE 


ORBITER 

1 


Reaction Control System (RCS) primary 
thruster R1U failed off during External 
Tank (ET) separation maneuver. 

IFANo. STS-37- V-01 

HR No. ORBI-056 {AR} 


RCS primary thruster R1U failed off during the STS-37 ET separation maneuver. 
Recorded pressure data indicated that the thruster Chamber Pressure (P c ) was 
10 pounds per square inch absolute (psia); nominal P c is 150 psia at thruster firing. 
Thruster injector temperatures indicated some oxidizer and fuel flow in R1U when 
firing was attempted. R1U was deselected by Redundancy Management (RM) and 
remained off for the remainder of the mission. 

Several similar thruster anomalies of this type were experienced on previous 
missions. Pressure traces from the STS-37 R1U failure were similar to those seen 
on R3D and R4R on STS-36. Iron nitrate contamination of the oxidizer valve 
poppet was determined to be the cause of both STS-36 thruster failures. Iron 
nitrate contamination forms when the oxidizer, Nitrogen Tetroxide (N 2 0 4 ), is 
allowed to contact moisture in ambient air. This contamination prevented the 
oxidizer valves from opening in the time allotted to achieve proper P c . It is believed 
that iron nitrate contamination may also have caused R1U to fail. R1U was 
removed when OV-104 returned to Kennedy Space Center (KSC); the unit was sent 
to the White Sands Test Facility (WSTF) for further analysis. 


2 


Water Spray Boiler (WSB) #2 did not 
cool Auxiliary Power Unit (APU) lube oil 
while under operation of controller "A". 

IFANo. STS-37- V-02A 

HR No. ORBI-036 {AR} 


WSB #2 failed to cool APU #2 lube oil after the end of the pool boiling period 
during ascent. WSB #2 was under the operation of controller "A". The crew was 
directed to switch to controller "B" when lube oil temperature reached 
280° Fahrenheit (F); nominal cooling begins at 250 *F. Lube oil temperature had 
begun to drop just prior to the crew action. The same anomaly occurred during 
STS-38, the previous flight of OV-104. Both controller "A" and WSB #2 were 
removed and replaced after STS-38. 
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STS-37 INFLIGHT ANOMALIES 


ELEMENT/ 
SEQ. NO. 


ORB1TER 
2 (Continued) 


COMMENTS/RISK ACCEPTANCE 
ANOMALY RATIONALE 


WSB #2 did not cool APU lube oil while The most probable cause of this problem was freezing of the spray bar caused by 

under operation of controller "A". wax buildup in the WSB. Wax, in the form of pentaerythritol, is formed when the 

APU hydrazine fuel is allowed to mix with lube oil. Pentaerythritol will begin to 
melt when lube oil temperature exceeds 200 °F. There were no preflight indications 
of wax buildup in the APU #2 lube oil or in WSB #2. Research of this WSB 
cooling problem indicated an emerging trend when WSBs are paired with APU 
Serial Number (S/N) 208. Further investigation into this and other APU/WSB 
combinations is in work. To date, there have been no similar WSB cooling 
problems on OV-103. Nor has there been any evidence of high APU lube oil 
pressures on OV-103, a good indication that wax has not formed in the lube oil. 


Power Reactant Supply and Distribution 
(PRSD) Oxygen (0 2 ) manifold valve #2 
failed to close when commanded. 

IFANo. STS-37- V-03 

HR No. ORBI-094 {AR} 


PRSD 0 2 manifold valve #2 failed to close when commanded the first two times on 
orbit. The valve, S/N 28, finally closed on the third command and was left closed 
for the remainder of the STS-37 mission. 0 2 manifold valve #2 is 1 of 2 redundant 
valves used to isolate the manifold or PRSD supply tank from a system leak. 

Failure of both manifold valves to close would result in depletion of fuel cell 0 2 
reactants and potential loss of the 3 fuel cell power plants. 

0 2 manifold valve #2, S/N 28, previously failed to close when first commanded on 
OV-104 during STS-34. Postflight troubleshooting found no problems with the 
valve operation, and the anomaly was closed as unexplained. S/N 28 worked 
properly on the 2 OV-104 flights between STS-34 and STS-37: STS-36 and STS-38. 
Troubleshooting at Dryden found no problem. S/N 28 was removed and replaced 
when OV-104 returned to KSC. 
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STS-37 INFLIGHT ANOMALIES 


ELEMENT/ 

SEQ. NO. ANOMALY 


COMMENTS/RISK ACCEPTANCE 
RATIONALE 


ORBITER 

4 


Indications of low P c on primary thrusters During STS-38/OV-104, low P c was experienced on 4 primary thrusters: R1U, R3D, 

LIU and L1L during interconnect RF3L, and R4U. Postflight troubleshooting did not reveal any thruster leaks or 

operations. other anomalies that might lead to low thruster P c . 


IFANo. STS-37- V-08 
HR No. ORBI-056 {C} 


Recent analysis determined that STS-38 thrusters R1U, R3D, RF3L, and R4U all 
indicated low P c during interconnect operations; the right pod thruster manifold was 
interconnected to the left Orbital Maneuvering System (OMS) propellant tanks. 
When RP03 propellant source was switched from the right OMS propellant tanks 
back to the straight feed configuration, thruster P c in R1U, R3D, RF3L, and R4U 
returned to nominal. This finding led to the decision to perform thruster firings on 
STS-37/OV-104 in the interconnect configuration. When this was performed, 
thrusters LIU and L1L showed degraded P,, approximately 130 psia instead of 
150 psia nominal. P c in LIU and L1L returned to nominal after reconfiguration to 
straight feed. It is believed that there may be contamination in the oxidizer 
interconnect line. Troubleshooting will be performed at KSC. 


5 


Backup Flight System (BFS) navigation Postlaunch data analysis of the BFS telemetry indicated that, from the prelaunch 

initialization anomaly. BFS OPS-1 transition until the T-8 second (sec) BFS reinitialization, the 

Z-component (altitude) of the BFS state vector was increasing at a rate of 
IFA No. STS-37- V-09 approximately 1 foot per second (ft/sec) to approximately 7700 feet (ft). The BFS 

navigation errors were cleared at the T-8 sec point in the launch countdown when 
HR No. ORBI-066 (AR) the BFS was reinitialized to the pad B position. Ascent telemetry review indicated 

that both the BFS and the Primary Avionics Software System (PASS) performed 
nominally. 
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STS-37 INFLIGHT ANOMALIES 


ELEMENT/ 


COMMENTS/RISK ACCEPTANCE 

SEQ. NO. 

ANOMALY 

RATIONALE 


ORBITER 

5 (Continued) BFS navigation initialization anomaly. Data review found that the Z-component was approximately 250 ft at the OPS-1 

transition plus 3-minute (mb) point; previous flight data bdicated the Zr component 
to be 6 to 30 ft during the same time b the launch countdown. Durbg previous 
launch countdowns, Z-component errors of 1500 to 3000 ft were observed up to the 
T-8 sec period. Recent pre-STS-37 tests, conducted b the Shuttle Avionics 
Integration Laboratory (SAIL) with the new General Purpose Computers (GPCs), 
demonstrated errors of 4000 to 4500 ft. Errors are believed to be caused by gravity 
feedback, and this eventually leads to error growth b the Z-component. 

The investigation included a code audit of the BFS and PASS. This audit 
determined that the problem was only in the first initialization of the navigation 
function in the BFS. The PASS navigation function did not have the same 
problems. Testbg of the BFS at the SAIL repeated the STS-37 prelaunch anomaly 
on each attempt and demonstrated that the problem was not from the Inertial 
Measurement Unit (IMU) bput. It is believed that this anomaly was caused by the 
increased processing time of the new GPCs, combined with the way the BFS 
sequences initialization of the navigation function. Discrepancy Report (DR) 

106197 was generated to identify this problem for resolution. 
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STS-37 INFLIGHT ANOMALIES 


ELEMENT/ 
SEQ. NO. 


ORBITER 

6 


COMMENTS/RISK ACCEPTANCE 
ANOMALY RATIONALE 


WSB #3 overcool during entry. 
IFANo. STS-37- V-12 
HR No. ORBI-036 {AR} 


System #3 post-Main Engine Cutoff (MECO) APU/WSB lube oil temperature ran 
cooler than the other 2 systems; lube oil return temperature was 231 °F minimum. 
System #3 saw a second overcool during entry, lube oil return temperature was 
211 °F minimum. 

System #3 APU/WSB showed evidence of contamination. High gearbox pressure 
was observed during the pad APU confidence run. The filter and oil were changed 
out prior to flight. 
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STS-37 INFLIGHT ANOMALIES 


ELEMENT/ 
SEQ. NO. 


SRB 

1 


COMMENTS/RISK ACCEPTANCE 
ANOMALY RATIONALE 


Left-Hand (LH) forward skirt skin panel During postflight inspection, the aft end of the LH forward skirt skin panel was 

buckling. found to have buckled on either side of the system tunnel. This forward skirt, 

S/N 22, had flown on STS-27R (BIO-030) and STS-33R (BIO-034). The STS-27R 
IFA No. STS-37-B-01 and STS-33 postflight inspection reports indicated no abnormal conditions of the 

LH forward skirt. STS-37 postflight orbiter data, reviewed through prelaunch, 
launch and separation, showed nominal flight conditions. Marshall Space Flight 
Center (MSFC) concluded that buckling was most likely caused by the slapdown 
load during water impact. The slapdown load on this booster was reported to be 
the highest ever recorded (92 g versus 12-40 g history). The dynamics of the Solid 
Rocket Booster (SRB) were likely affected by wave height, wave period, wave 
length, etc., of the sea-state 5 condition. 
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SECTION 8 


BACKGROUND INFORMATION 


This section contains pertinent background information on the safety risk factors 
and anomalies addressed in Sections 3 through 7. It is intended as a supplement to 
provide more detailed data if required. This section is available upon request. 
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LIST OF ACRONYMS 


ACO 

Acceptance Checkout 

ADI 

Attitude Direction Indicator 

AFB 

Air Force Base 

AMOS 

Air Force Maui Optical Station 

APM 

Ascent Particle Monitor 

APU 

Auxiliary Power Unit 

AR 

Accepted Risk 

ATE 

Automatic Test Equipment 

BATSE 

Burst and Transient Source Experiment 

BFS 

Backup Flight System 

BIMDA 

Bioserve ITA Materials Dispersion Apparatus 

BITE 

Built-In Test Equipment 

C 

Controlled 

CA 

California 

CAR 

Corrective Action Report 

CAV 

Captive Air Vent 

CB 

Circuit Breaker 

CCP 

Carbon Cloth Phenolic 

CETA 

Crew and Equipment Transaction Aid 

CIL 

Critical Item List 

CLIP 

Crew Loads Instruments Pallet Experiment 

CMOS 

Complementary Metal Oxide Silicon 

CO AS 

Crew Optical Alignment Sight 

COMPTEL 

Imaging Compton Telescope 

CR 

Change Request 

Crit 

Criticality 

CRT 

Cathode Ray Tube 

CTI 

Charlton Technologies, Inc. 

CWC 

Contingency Water Container 

CWS 

Caution and Warning System 

DAR 

Deviation Approval Request 

DDU 

Display Driver Unit 

DEU 

Data Entry Unit 

DPS 

Data Processing System 

DR 

Discrepancy Report 

DSC 

Designated Signal Conditioner 

DSO 

Detailed Supplementary Objective 

DTO 

Development Test Objective 
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UST OF ACRONYMS - CONTINUED 


EAFB 

Edwards Air Force Base 

EDFE 

Extravehicular Activity Developmental Flight Experiment 

EDT 

Eastern Daylight Time 

EGRET 

Energetic Gamma Ray Experiment Telescope 

EGT 

Exhaust Gas Temperature 

EST 

Eastern Standard Time 

ET 

External Tank 

ETE 

Extravehicular Activity Translation Evaluation 

EVA 

Extravehicular Activity 

F 

Fahrenheit 

FASCOS 

Flight Acceleration Safety Cutoff System 

FCV 

Flow Control Valve 

FD 

Flight Day 

FDA 

Fault Detection and Annunciation 

FES 

Flash Evaporator System 

FMEA 

Failure Modes and Effects Analysis 

FMEA/CIL 

Failure Modes and Effects Analysis/Critical Items List 

FOS 

Factor of Safety 

FR 

Flight Rule 

FRI 

Flow Recirculation Inhibitor 

FRR 

Flight Readiness Review 

ft 

Feet 

ft-lb 

Foot-Pounds 

ft/sec 

Foot Per Second 

GGVM 

Gas Generator Valve Module 

gh 2 

Gaseous Hydrogen 

GN&C 

Guidance, Navigation and Control 

gn 2 

Gaseous Nitrogen 

go 2 

Gaseous Oxygen 

GOX 

Gaseous Oxygen 

GPC 

General Purpose Computer 

GRO 

Gamma Ray Observatory 

GSE 

Ground Support Equipment 

h 2 

Hydrogen 

HAC 

Heading Alignment Cone 

HCF 

High-Cycle Fatigue 

HDS 

Hydrogen Dispersal System 

HGDS 

Hazardous Gas Detection System 

HPFTP 

High-Pressure Fuel Turbopump 
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LIST OF ACRONYMS - CONTINUED 


HPM 

High Performance Motor 

HPOTP 

High-Pressure Oxidizer Turbopump 

HR 

Hazard Report 

hr 

Hours 

HST 

Hubble Space Telescope 

I/O 

Input/Output 

IBR 

Inner Boot Ring 

IEA 

Integrated Electronics Assembly 

IFA 

Inflight Anomaly 

IMU 

Inertial Measurement Unit 

in-lb 

Inch-Pounds 

INTG 

Integration 

IPL 

Initial Program Load 

JSC 

Johnson Space Center 

K 

Kilobytes 

KSC 

Kennedy Space Center 

ksi 

Thousand Pounds Per Square Inch 

L-2 

Launch Minus 2 Day 

lb 

Pounds 

LCC 

Launch Commit Criteria 

LCF 

Low-Cycle Fatigue 

LH 

Left-Hand 

lh 2 

Liquid Hydrogen 

lo 2 

Liquid Oxygen 

LOX 

Liquid Oxygen 

LPFTP 

Low-Pressure Fuel Turbopump 

LPOTP 

Low-Pressure Oxidizer Turbopump 

LSFR 

Launch Site Flow Review 

M&P 

Materials and Processing 

MCC 

Main Combustion Chamber 

MDM 

Multiplexer-Demultiplexer 

ME 

Main Engine 

MEC 

Master Event Controller 

MECO 

Main Engine Cutoff 

MeV 

Million Electron Volts 

mg/ft 2 

Milligrams Per Square Foot 

min 

Minutes 
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MLG 

MLP 

MMC 

MMU 

MPS 

MPU 

MSE 

MSFC 


N 2 0 4 

NASA 

NDE 

NLG 

NSRS 

o 2 

OMI 

OMRSD 

OMS 

OOR 

OPF 

OPS 

OSMQ 

OSSE 

OV 

P/N 

PAR 

PASS 

Pc 

PCG 

PDU 

PLBD 

ppm 

PRCB 

PRSD 

psi 

psia 

psid 

psig 


LIST OF ACRONYMS - CONTINUED 


Main Landing Gear 
Mobile Launch Platform 
Martin Marietta Corporation 
Mass Memory Unit 
Main Propulsion System 
Magnetic Pickup Unit 
Mission Safety Evaluation 
Marshall Space Flight Center 

Nitrogen 

Nitrogen Tetroxide 

National Aeronautics and Space Administration 

Nondestructive Evaluation 

Nose Landing Gear 

NASA Safety Reporting System 

Oxygen 

Operation and Maintenance Instruction 

Operational Maintenance Requirements and Specifications Document 

Orbital Maneuvering System 

On-Orbit Refueling 

Orbiter Processing Facility 

Operational Sequence 

Office of Safety and Mission Quality 

Oriented Scintillation Spectrometer Experiment 

Orbiter Vehicle 

Part Number 

Prelaunch Assessment Review 
Primary Avionics Software System 
Chamber Pressure 
Protein Crystal Growth 
Power Distribution Unit 
Payload Bay Door 
Parts Per Million 

Program Requirements Control Board 
Power Reactant Supply and Distribution 
Pounds Per Square Inch 
Pounds Per Square Inch Absolute 
Pounds Per Square Inch Differential 
Pounds Per Square Inch Gage 
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RCS 

RGA 

RH 

RI 

RM 

RME 

RMS 

rpm 

RSRM 

RTLS 

RTV 

S/N 

SAIL 

SAREX 

seem 

sees 

scfm 

sec 

SEM 

SHARE 

SM 

SMS 

SODB 

SOV 

Spec 

SRB 

SRM 

SSC 

SSME 

SSRP 

STA 

TAL 

TC 

TEM 

TPMS 

TPS 

TVC 


APPENDIX A 

LIST OF ACRONYMS - CONTINUED 


Reaction Control System 
Rate Gyro Assembly 
Right-Hand 
Rockwell International 
Redundancy Management 
Radiation Monitoring Equipment 
Remote Manipulator System 
Revolutions Per Minute 
Redesigned Solid Rocket Motor 
Return to Launch Site 
Room Temperature Vulcanizing 

Serial Number 

Shuttle Avionics Integration Laboratory 
Shuttle Amateur Radio Equipment 
Standard Cubic Centimeters Per Minute 
Standard Cubic Centimeters Per Second 
Standard Cubic Feet Per Minute 
Seconds 

Scanning Electron Microscope 

Space Station Heat Pipe Advanced Radiator Element 

Systems Management 

Shuttle Missile Simulator 

Shuttle Operational Data Book 

Shutoff Valve 

Specification 

Solid Rocket Booster 

Solid Rocket Motor 

Stennis Space Center 

Space Shuttle Main Engine 

System Safety Review Panel 

Shuttle Training Aircraft 

Transatlantic Abort Landing 
Thiokol Corporation 
Test and Evaluation Motor 
Tire Pressure Monitoring System 
Thermal Protection System 
Thrust Vector Control 
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U/N 

USBI 

WSB 

WSTF 


LIST OF ACRONYMS - CONTINUED 


Unit Number 

United Space Boosters, Inc. 

Water Spray Boiler 
White Sands Test Facility 
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